Android Car Head Units Turned Into Proxy Botnet Nodes

Kaspersky has analyzed a malicious campaign targeting Android-based automotive head units — the very systems that control a car's multimedia, navigation and settings. According to the researchers, this is the first documented case in which an infection chain was built specifically for a car's “stereo.”

The attack is attributed to the MoYu group, previously linked to the BadBox botnet. The target was devices made by the Chinese manufacturer DoFun (owned by Shenzhen Driving Control Technology), which produces stock Android head units along with cloud services.

How the infection works

In June, the researchers discovered that DoFun's legitimate system update app — TWCore — was pulling down a third-party APK. It received its commands via an MQTT server on the domain cardoor[.]cn. The downloaded app, named JarService, has no interface: on launch it decrypts and runs a second-stage loader, which contacts a command server and downloads yet another encrypted module.

The final payload periodically sends the operators data about the device — model, screen resolution, Wi-Fi network name (SSID) and MAC address — and receives commands. Nine instructions are supported in all: reading values from SharedPreferences storage, copying data to the clipboard, sending HTTP requests, opening a URL in a WebView while executing arbitrary JavaScript, downloading and running additional code, opening links in the browser, and checking host availability via ICMP. Some of the commands (loadlib and loadlib3) were not fully implemented at the time the report was published.

What the attackers get out of it

According to the researchers, the malware does not interfere with driving or with the car's critical systems. Its purpose is purely commercial: advertising fraud and turning an internet-connected head unit into a node in a residential proxy network. Most often the operators loaded a reverse-proxy module called zhima, which made the device part of the botnet, and they also generated web requests to inflate click counts.

Kaspersky notified DoFun of the findings, and the Chinese company said the issue had been fixed. Bleeping Computer sent both companies questions about the initial compromise vector and promised to update its article once a response was received.

The case is notable because it shows that a device whose security a car owner almost never thinks about can quietly earn money for strangers for years on end — all without getting in the way of the navigation or the music.

Source: Bleeping Computer