German BSI Disrupts Android Malware Infecting IoT Devices

The German federal information security agency disrupted a botnet that infected thousands of backdoored digital picture frames and media players made with knock-off Android operating systems shipped from China.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The malware campaign, dubbed Badbox, was first uncovered by cybersecurity firm Human Security last year (see: Chinese Criminals Backdoor Android Devices for Ad Fraud.).

The Federal Office for Information Security on Thursday said it is sinkholing Badbox internet traffic. Infected devices contain a variant of the Triada Trojan, which operators use for creating residential proxies or advertising click fraud. They can also surreptitiously create accounts for email and messenger services in order to spread disinformation.

Officials from the agency, known as the BSI for its German acronym, said Badbox-infected devices don’t present a danger so long as the sinkholing continues. The agency identified at least 30,000 infected devices. It requested telecommunication service providers notify customers whose devices have carry the Trojan.

Human Security when it published its Badbox research said it didn’t know how Badbox malware reaches devices. It’s possible that criminal actors steal Android gadgets including phones, tablets and streaming devices and reinsert them into the supply chain with malicious code as an unwanted bonus. They might inject their firmware backdoor directly on the factory floor in collusion with at least one Chinese manufacturer.

Human Security found evidence of “at least 200 distinct Android device types” infected with the backdoor. It’s impossible to calculate how many devices across the globe carry the malware, but Human Security said it observed at least 74,000 infected gadgets.

Supply chain compromises are difficult to combat, since consumers assume the goods for sale on any semi-reputable e-commerce site are safe, Gavin Reid, Human Security’s chief information security officer, told Information Security Media Group. “That is not the case,” he said, adding that if the price of a tablet seems too good to believe, it probably is.