Rewterz Threat Update – Mirai Variant Using Android TV Boxes for DDoS Attacks

Severity

High

Analysis Summary

A new variant of the Mirai malware botnet has been discovered infiltrating inexpensive Android TV set-top boxes, typically used for media streaming. This trojan is the newest version of the 2015 Pandora backdoor.

This campaign is mainly targeting Android TV boxes that have the quad-core processor features like H96 MAX X3, MX10 Pro 6K, and Tanix TX6 TV Box as they are capable of launching DDoS attacks. The malware infects these devices through a malicious update that is signed with test keys that are publicly available, or using malicious apps downloaded with pirated content.

“It is likely that this update has been made available for download from a number of websites, as it is signed with publicly available Android Open Source Project test keys,”, according to the published analysis

Most of the time, these firmware updates are installed by people reselling the device. Some users are also misled into downloading the updates from malicious websites disguised as providing free media streaming. ‘boot.img’ is a malicious service contains the ram disk and kernel components already loaded during the bootup, making it a good persistence mechanism.

Apps that provide pirated content to be downloaded for free are used to distribute this malware. To achieve persistence in this scenario, the launch of the malicious apps starts the ‘GoMediaService’ in the background stealthily and is set to start automatically whenever the device boots.

It then calls the ‘gomediad.so’ program in order to unpack various files, including an installer for the Pandora backdoor and a command-line interpreter that is able to run with elevated privileges. Afterwards, the backdoor activates and starts communication with the C2 server, updates itself, replaces the files and enters into standby mode while waiting for more command from the operators.

The malware is capable of performing DDoS attacks over the UDP and TCP protocols by generating SYN, DNS and ICMP request floods, and many other ways. It is recommended to buy devices from trusted brands to avoid becoming a victim of these malwares.

Impact

• Unauthorized Access

Remediation

• Ensure that firmware updates are received only from official sources and not from third-party websites or unverified sources.
• Avoid downloading firmware updates from unfamiliar websites or links shared through unverified sources.
• Only install apps from trusted sources, such as Google Play Store for Android TV. Avoid sideloading apps from unverified third-party sources.
• Consider installing reputable security software or antivirus apps on your Android TV box to detect and block malware.
• If the device allows you to change default passwords or access credentials, do so immediately to prevent unauthorized access.
• Use a strong and unique Wi-Fi password to secure your home network.
• Consider implementing network-level security features like firewalls and intrusion detection/prevention systems to monitor and block malicious network traffic.
• Isolate your Android TV box from other devices on your network to minimize the potential impact of a compromise.
• Patch – Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• 2FA – Enable two-factor authentication.
• Antivirus – Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using a multi-layered protection is necessary to secure vulnerable assets.