Car infotainment units have joined the list of devices that criminals quietly rent out as proxies. Kaspersky researchers have documented malware that reached Android head units through the units' own software update mechanism, then turned them into nodes of a proxy botnet and tools for advertising fraud. They say it is the first known case of malware with an infection chain built specifically for this kind of device.
The devices in question use firmware made by DoFun, a company in China whose software ships on aftermarket head units, the touchscreen systems that drivers install to replace a factory radio. Head units often have a SIM card slot and an internet connection of their own, which they use for navigation and updates.
Kaspersky came across the malware in June while tracking Android threats. An app with no user interface at all was turning up on devices, which suggested that owners had not installed it themselves. Following the trail back led to TWCore, a legitimate system application in the DoFun firmware that collects analytics and handles updates.
TWCore listens to a message broker on a remote server and receives lists of app packages to download and install. One field in those messages tells it whether an app may be installed even if it was never on the device before. With that flag set, the updater will put a brand new application on the head unit without asking anyone. Somebody used this channel to deliver a package called JarService.
JarService is only a wrapper. It decrypts and starts a loader, which reports basic details about the device to a remote server and gets back a link to the next stage. The link contains a version number, and by trying other numbers the researchers retrieved seven variants of that payload. That points to an operation that has been maintained and updated for some time.
The final component checks in with its server every 90 minutes. It sends the unit's model, screen resolution, the name of the WiFi network it is connected to and its MAC address, then waits for instructions. Nine commands are built in. They can open a web page in an invisible browser view and run JavaScript in it, send arbitrary web requests, write to the clipboard, test whether an address is reachable and download additional code. Two of the nine were unfinished when Kaspersky published its analysis.
In practice the operators used only two. One fired off web requests of the kind used in click fraud. The other downloaded a module called zhima, a reverse proxy that lets paying customers route their traffic through the car's internet connection. Proxy networks built from home and mobile connections are in demand because traffic from them looks like it comes from ordinary consumers, which helps with everything from scraping to credential stuffing.
Kaspersky attributes the campaign with high confidence to the MoYu Group, which has been tied to BADBOX, the botnet made up largely of cheap Android devices that ship with a backdoor already in the firmware. Researchers at Nokia independently found the same zhima module on TV set top boxes at around the same time, which fits the picture of one crew extending a proven business to new hardware.
Drivers were not in physical danger. The malware does not touch driving functions or vehicle controls, and a head unit holds little that is worth stealing. What it does have is a network connection and an owner who has no easy way to see what is running on it.
Kaspersky reported the problem to DoFun, and the company told the researchers it has fixed it. What remains unexplained is how the attackers were able to send instructions through the update channel in the first place.
