Android Malware Targets Automotive Head Units via Firmware Updates
Kaspersky researchers have identified a novel Android malware campaign specifically targeting automotive head units, marking the first documented instance of malware infecting these in-car systems through their firmware update mechanisms.
Kaspersky researchers have uncovered a new Android malware campaign that specifically targets automotive head units, a critical component in modern vehicles that integrates multimedia functions with vehicle controls. This discovery is significant as it represents the first documented instance of malware infecting car head units with an infection chain tailored to this specific device type. The malware, a multi-stage downloader, is designed for ad fraud and the creation of a proxy botnet, leveraging the head unit's internet connectivity.
The infection chain exploits a vulnerability within the firmware update process of DoFun brand head units. The TWCore application, a legitimate system app responsible for analytics and software updates, inadvertently facilitates the malware's installation. Attackers can manipulate the update mechanism, which uses MQTT messages to distribute APK files. A key element of the exploit is the installNotExists flag within the update process, which, when set to true, allows TWCore to install applications even if they are not part of the original firmware, thereby enabling the silent deployment of malicious software.
Once the TWCore app downloads and installs the malicious payload, the first stage, known as the JarService dropper, executes. This dropper is a small, UI-less application that decrypts embedded malicious code. It uses a simple XOR encryption with a shifting single-byte key to obfuscate its payload. The decrypted data contains serialized information about the next stage, including the entry point for further execution, effectively acting as a loader for the subsequent malicious components.
The second stage involves a malicious loader that uses reflection to execute further payloads. This loader communicates with a command-and-control (C2) server, sending implant information such as device details, app versions, and channel IDs. In return, the C2 server provides a URL to download the next stage of the malware. This stage-and-a-half approach allows attackers to maintain flexibility and potentially update their malicious infrastructure without needing to re-infect devices with the initial dropper.
The ultimate goal of this malware, as identified by Kaspersky, is to engage in ad fraud and establish a proxy botnet. By compromising the head unit, attackers can force the device to generate fraudulent ad revenue or use its internet connection as a proxy for other malicious activities. This is particularly concerning given the increasing connectivity and data capabilities of modern vehicles, which could be exploited for a wide range of illicit purposes.
Kaspersky attributes this campaign with high confidence to the MoYu Group, an actor previously linked to the BADBOX botnet. This attribution suggests a sophisticated and persistent threat actor capable of adapting their tactics to new targets and environments. The group's focus on ad fraud and botnet creation aligns with their known modus operandi.
Kaspersky solutions detect the various stages of this malware under several names, including HEUR:Trojan-Dropper.AndroidOS.Agent.vu, HEUR:Trojan-Downloader.AndroidOS.Agent.ov, HEUR:Trojan-Proxy.AndroidOS.Zhima.*, and HEUR:Trojan.AndroidOS.Vo1d.*. The vendor, DoFun, has been notified of the security issues and has reportedly implemented fixes to address the vulnerabilities in their head unit firmware, closing this specific infection vector.