Amazon reportedly delivers Android TV box with pre-installed malware


By MYBRANDBOOK


Amazon reportedly delivers Android TV box with pre-installed malware

A Canadian system administrator discovered that an Android TV box, namely the T95 Android TV box, purchased from Amazon was pre-loaded with persistent, sophisticated malware baked into its firmware.

 

The buyer initially bought the device to run the Pi-hole DNS sinkhole, which protects devices from unwanted content, advertisements, and malicious sites without installing software, but, instead, he discovered that the device was attempting to connect to several IP addresses associated with active malware.

 

He said that the malware installed on the device is ‘CopyCat’, a sophisticated Android malware first discovered by Check Point in 2017. This malware was previously seen in an adware campaign where it infected 14 million Android devices to make its operators over $1,500,000 in profits.

 

The T95 streaming device uses an Android 10-based ROM signed with test keys and the ADB (Android Debug Bridge) open over Ethernet and WiFi. This is a suspicious configuration as ADB can be used to connect to devices for unrestricted filesystem access, command execution, software installation, data modification, and remote control.

 

T95 users are recommended to follow these simple steps to clean their device and nullify the malware that runs on it:

 

1. Reboot into recovery mode or perform “Factory Reset” from the settings menu.

2. Upon reboot, connect to ADB via USB or WiFi-Ethernet and run this script.

 E-Magazine 
 VIDEOS  Placeholder image

Copyright www.mybrandbook.co.in @1999-2024 - All rights reserved.
Reproduction in whole or in part in any form or medium without express written permission of Kalinga Digital Media Pvt. Ltd. is prohibited.
Other Initiatives : www.varindia.com | www.spoindia.org