In a groundbreaking discovery, cybersecurity experts at Kaspersky have identified the first malware specifically targeting vehicle infotainment systems, with connections to the notorious BadBox botnet. This revelation highlights an emerging threat in the automotive cybersecurity landscape.
Vulnerability in Car Infotainment Systems
The malware was detected on an Android-based aftermarket infotainment system produced by the Chinese manufacturer DoFun. These systems are prevalent across China and other Asia-Pacific regions, making them a significant target for cybercriminals. Kaspersky’s investigation revealed that attackers exploited a vulnerability in the system’s software update mechanism, allowing them to inject malicious software into the vehicle head units.
Following the discovery, DoFun promptly addressed the security flaw after receiving notification from Kaspersky. The breach involved compromising the update distribution channel to deploy malicious Android applications, which functioned as droppers, loaders, and reverse-proxy loaders.
Malware Functionality and Objectives
This sophisticated malware supports nine different commands, enabling operators to display ads, commit ad fraud through a clicker component, and download further malware components. Despite its wide array of capabilities, Kaspersky researchers have primarily observed the malware being used to download a reverse proxy module. This suggests the primary objective is to incorporate affected devices into a proxy botnet.
Further scrutiny led Kaspersky to attribute the malware to the MoYu Group, known collaborators in the development of the BadBox botnet. The BadBox network has been operational since at least 2023, utilizing compromised Android devices for various fraudulent activities.
Expanding Threat of the BadBox Botnet
The BadBox botnet has been a significant concern for law enforcement agencies, which have made several attempts to dismantle it. However, the threat continues to escalate, with Google filing a lawsuit last year against the operators of BadBox 2.0. Reports indicate that the botnet has compromised over 10 million Android devices, predominantly TV boxes.
The emergence of malware targeting vehicle infotainment systems indicates a strategic expansion in the botnet’s distribution methods and targets. Initially, BadBox malware was often pre-installed on low-cost devices, but its operators are now diversifying their attack vectors to include automotive systems.
As cybersecurity threats continue to evolve, it remains crucial for manufacturers and consumers alike to prioritize security measures to safeguard digital infrastructure and connected devices.
