A new variant of the Mirai malware botnet has been discovered infiltrating inexpensive Android TV set-top boxes, typically used for media streaming. This trojan is the newest version of the 2015 Pandora backdoor.
This campaign is mainly targeting Android TV boxes that have the quad-core processor features like H96 MAX X3, MX10 Pro 6K, and Tanix TX6 TV Box as they are capable of launching DDoS attacks. The malware infects these devices through a malicious update that is signed with test keys that are publicly available, or using malicious apps downloaded with pirated content.
“It is likely that this update has been made available for download from a number of websites, as it is signed with publicly available Android Open Source Project test keys,”, according to the published analysis
Most of the time, these firmware updates are installed by people reselling the device. Some users are also misled into downloading the updates from malicious websites disguised as providing free media streaming. ‘boot.img’ is a malicious service contains the ram disk and kernel components already loaded during the bootup, making it a good persistence mechanism.
Apps that provide pirated content to be downloaded for free are used to distribute this malware. To achieve persistence in this scenario, the launch of the malicious apps starts the ‘GoMediaService’ in the background stealthily and is set to start automatically whenever the device boots.
It then calls the ‘gomediad.so’ program in order to unpack various files, including an installer for the Pandora backdoor and a command-line interpreter that is able to run with elevated privileges. Afterwards, the backdoor activates and starts communication with the C2 server, updates itself, replaces the files and enters into standby mode while waiting for more command from the operators.
The malware is capable of performing DDoS attacks over the UDP and TCP protocols by generating SYN, DNS and ICMP request floods, and many other ways. It is recommended to buy devices from trusted brands to avoid becoming a victim of these malwares.