Android TV box on Amazon came pre-installed with malware

guest · Jan 12, 2023

By Bill Toulas @billtoulas - January 12, 2023

A Canadian system administrator discovered that an Android TV box purchased from Amazon was pre-loaded with persistent, sophisticated malware baked into its firmware.
Click to expand...

The malware was discovered by Daniel Milisic, who created a script and instructions to help users nullify the payload and stop its communication with the C2 (command and control) server.

The device in question is the T95 Android TV box with an AllWinner T616 processor, widely available through Amazon, AliExpress, and other big e-commerce platforms.
It is unclear if this single device was affected or if all devices from this model or brand include the malicious component.
Click to expand...

Malware on the TV streaming box
The T95 streaming device uses an Android 10-based ROM signed with test keys and the ADB (Android Debug Bridge) open over Ethernet and WiFi.
While analyzing the DNS request in Pi-hole, Milisic discovered that the device was attempting to connect to several IP addresses associated with active malware.

Milisic believes the malware installed on the device is 'CopyCat,' a sophisticated Android malware first discovered by Check Point in 2017. This malware was previously seen in an adware campaign where it infected 14 million Android devices to make its operators over $1,500,000 in profits.
Click to expand...

"I found layers on top of layers of malware using 'tcpflow' and 'nethogs' to monitor traffic and traced it back to the offending process/APK, which I then removed from the ROM," explains the analyst in a GitHub post.
"The final bit of malware I could not track down injects the 'system_server' process and looks to be deeply baked into the ROM."
Click to expand...

However, as these devices are fairly inexpensive on Amazon, it may be wiser to discontinue using them if you can afford to do so.
Click to expand...

Rasheed187 · Jan 16, 2023

This is a bit troubling, so it's probably best not to buy these less known streaming boxes. Better stick to the well known names.

guest · Feb 1, 2023

Amazon Still Selling T95 TV Box with Pre-Installed Malware
By Deeba Ahmed - February 1, 2023

A few weeks back, Hackread.com reported about a malware-infected Android TV box available on Amazon: the T95 TV box. The box contained pre-installed malware, which was discovered by a Canadian developer and security systems consultant, Daniel Milisic.
Click to expand...

Now the same TV box is in the news again, and the person who has identified security threats is Malwarebytes mobile malware researcher Nathan Collier. He purchased this device from Amazon to further probe and instantly realized something was off about this TV box. Collier discovered that regardless of whether the toggle switch was on or off, the box was rooted.
Click to expand...

How to Fix the Issue?
In a blog post, Collier recommends a factory reset before proceeding to fix the issue. A factory reset will remove the malware that might have been downloaded during this time. Afterwards, avoid connecting the box to a network until you install adb onto a Linux, Windows, or Mac environment and put the box into Developer Mode.

Turn on USB0 device mode to install adb. Connect your PC to the box, open a terminal such as Command Prompt on PC, and type: adb devices, which will display an ID number and a list of devices attached. Now you can remove the DGBLuancher. Check out Nathan Collier’s blog on Malwarebytes for a detailed remediation process.
Click to expand...

Malwarebytes: Analyzing and remediating a malware infested T95 TV box from Amazon

by Nathan Collier - January 30, 2023
A couple of weeks ago, security news outlets made their rounds reporting on an Android TV box available on Amazon that came pre-installed with malware. The findings came from a Canadian developer, Daniel Milisic, who posted on his GitHub. What Daniel found was an Android T95 TV box infected with malware right out of the box!

The following is my analysis after days of obsessing over this little black box.
Click to expand...

Log in or Sign up

Android TV box on Amazon came pre-installed with malware

guest Guest

Rasheed187 Registered Member

guest Guest

Log in or Sign up

Android TV box on Amazon came pre-installed with malware

guest Guest

Rasheed187 Registered Member

guest Guest

Useful Searches