Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label BadBox threat. Show all posts
Software
Android BadBox threat Credential Theft FBI malware Software

FBI Issues Urgent Warning: Millions of Android Devices Compromised by Malware Operation

 


A dangerous malware campaign known as BadBox 2.0 has infected more than 10 million Android-powered devices, according to a recent alert from the FBI and major cybersecurity researchers. Users are being advised to immediately disconnect any suspicious smart devices connected to their home networks.

This large-scale cyberattack targets a range of low-cost electronics, such as smart TVs, tablets, digital picture frames, car infotainment systems, and streaming boxes, many of which are manufactured by lesser-known brands and sold at discounted prices. Authorities warn that these products may already be infected before leaving the factory.


How Are Devices Getting Infected?

Investigators say that the malware is often pre-installed into the system’s firmware, meaning it’s embedded into the device itself. In some cases, users unknowingly allow the malware in when accepting software updates or installing apps from unofficial sources.

Once active, the malware can silently take over the infected device, turning it into part of a global botnet. These infected devices are then used by cybercriminals for illegal activities like online ad fraud, credential theft, and hiding internet traffic through proxy networks.

The LAT61 Threat Intelligence Team at Point Wild helped trace how the malware operates. They discovered that the malware secretly converts devices into residential proxy nodes, making it hard to detect while still carrying out harmful actions behind the scenes.


What Are Google and the FBI Doing?

In response to the threat, Google has taken legal action against the individuals behind BadBox 2.0 and has updated its Google Play Protect system to block apps associated with the malware. The FBI, through alert I-060525-PSA, has also issued a detailed warning and urged users to take caution, especially with devices from unverified brands.

The team at Human Security, which first exposed the malware operation, confirmed that multiple hacker groups contributed to building and maintaining the botnet infrastructure. Their CEO praised the collaboration between cybersecurity firms, law enforcement, and tech companies to take down the threat.


A New Threat Also Detected

Meanwhile, researchers from GreyNoise have reported signs of another emerging cyber threat, this time involving VoIP (Voice over Internet Protocol) devices. Their investigation revealed a spike in activity where hackers are attempting to gain access to poorly secured systems using default or weak passwords. These devices are often older, rarely updated, and left exposed to the internet, making them easy targets.


What Should You Do?

The FBI advises users to look out for the following red flags:

1. Devices requiring you to turn off Google Play Protect

2. Gadgets that offer “fully unlocked” or “free streaming” features

3. Unfamiliar or generic brand names

4. Apps from third-party app stores

5. Unexpected internet activity from your devices


If you notice any of these signs, disconnect the device from your network immediately and consider replacing it with a trusted brand.

Read more »
preinstalled malware
Android Malware BadBox threat digital frame vulnerabilities infected Android devices malware media player malware preinstalled malware

Malware Found Preinstalled on 30,000 Android Devices in Germany

 

A concerning cybersecurity issue has surfaced in Germany, where investigators uncovered that nearly 30,000 Android devices were sold with preinstalled malware.

The malware, dubbed “BadBox,” resides in the device firmware and affects various internet-enabled devices, including digital picture frames and media players operating on outdated Android versions, according to the Federal Office for Information Security (BSI).

“In all cases known to the BSI, the BadBox malware was already installed on the respective devices when they were purchased,” the agency confirmed in its report.

Once active, the malware can repurpose infected devices into tools for cybercriminals, enabling them to exploit home internet networks to launch attacks. It can also download additional malware and conduct fraudulent activities by accessing websites and ads in the background.

To mitigate the threat, the BSI has employed a method called “sinkholing,” which redirects internet traffic from compromised devices to servers controlled by the government. This measure prevents the malware from connecting to the hackers’ command systems.

“There is no acute danger for these devices as long as the BSI maintains the sinkholing measure,” the agency reassured. Nonetheless, users are strongly urged to disconnect any infected devices from the internet. Telecommunications companies in Germany are assisting by notifying affected users through IP address tracking.

The exact products impacted by this issue remain unidentified, leaving questions about how the malware was preinstalled. The BSI also warned that similar malware risks could affect tablets and smartphones.

This isn’t the first instance of preloaded malware on consumer electronics. Last year, a security researcher discovered an Android TV box sold on Amazon with hidden malware. The BSI advises consumers to prioritize security when purchasing electronics, emphasizing the importance of safety features, official manufacturer support, and updated operating systems.

Google also addressed the issue, clarifying:
“These off-brand devices discovered to be infected were not Play Protect certified Android devices. If a device isn't Play Protect certified, Google doesn’t have a record of security and compatibility test results.”

The company added, “Play Protect certified Android devices undergo extensive testing to ensure quality and user safety. To help you confirm whether or not a device is built with Android TV OS and Play Protect certified, our Android TV website provides the most up-to-date list of partners. You can also take these steps to check if your device is Play Protect certified.”

This incident underscores the need for heightened awareness when purchasing electronics, particularly from lesser-known brands, to ensure devices meet security and quality standards.
Read more »
Subscribe to: Posts (Atom)