Pierluigi Paganini October 09, 2023

Researchers warn that more than 70,000 Android smartphones, CTV boxes, and tablets were shipped with backdoored firmware as part of BADBOX network.

Cybersecurity researchers at Human Security discovered a global network of consumer products, dubbed BADBOX, with firmware backdoors installed and sold through a compromised hardware supply chain.

The experts reported that at least 74,000 Android-based mobile phones, tablets, and Connected TV boxes worldwide were shipped with the backdoored firmware.

Products containing the malicious backdoor have been found on public school networks throughout the United States.

Human Security identified a supply chain of a Chinese manufacturer that was compromised to backdoor the firmware of several products delivered to resellers, physical retail stores and e-commerce warehouses. The firmware backdoor was based on the Triada malware, which is a backdoor that was found over the years in several low-cost Android smartphones. 

The Triada Trojan was spotted for the first time in 2016 by researchers at Kaspersky Lab that considered it the most advanced mobile threat seen to the date of the discovery.

Triada was designed with the specific intent to implement financial frauds, typically hijacking the financial SMS transactions. The most interesting characteristic of the Triada Trojan apart is its modular architecture, which gives it theoretically a wide range of abilities.

The Triada Trojan makes use of the Zygote parent process to implement its code in the context of all software on the device, this means that the threat is able to run in each application.

The only way to remove the threat is to wipe the smartphone and reinstall the OS.

In 2018, researchers at Dr.Web discovered the Triada Trojan pre-installed on newly shipped devices of several minor brands, including Advan, Cherry Mobile, Doogee, and Leagoo.

It was not the first time the company discovered pre-installed malware on Android devices, back in July 2017 Dr..Web researchers discovered many smartphone models were shipped with the dreaded Triada trojan such as Leagoo M5 Plus, Leagoo M8, Nomu S10, and Nomu S20.

The backdoor allows injecting additional modules into device memory, enabling the threat actors to conduct several types of fraud, the establishment of residential proxy exit nodes, the creation of fake Gmail and WhatsApp accounts, and remote unpermissioned code installation.

“One of the modules deposited by the C2 servers enables BADBOX-infected smartphones, tablets, and CTV boxes to create WebViews fully hidden from the eyes of the owner. Those WebViews are used to request, render, and click on ads, spoofing the ad requests to look like they’re coming from certain apps, referred by certain websites, and rendered on certain models of smartphones, tablets, and CTVs, none of which are true.” reads the report published by Human Security. “This module is one component of PEACHPIT, the ad fraud portion of BADBOX. PEACHPIT may be the element of the operation that pays for all of the others.”

One of the ad-fraud schemes implemented using this backdoor was named PeachPit, which reached a peak of 121,000 infected Android devices and 159,000 infected iOS devices. The infected devices generated an average of 4 billion ad requests a day.

As of the time of the publishing of the report, the PEACHPIT has been disrupted, while the other components of BADBOX network are dormant. The C2s employed in this campaign have been taken down by the threat actors, however, experts warn that they can reconfigure their schemes to continues their malicious activities.

The experts conclude by warning the owners of the compromised devices that is can be very complex to remove BADBOX from their product.

“Unfortunately, BADBOX-infected devices are unsalvageable by an average user. Since the malware is located on a readonly (ROM) partition of the device firmware, the average user won’t be able to remove BADBOX from their product. As BADBOX affects almost entirely lower-price-point, “offbrand” devices, the Satori team recommends that users stick to familiar brands when choosing new devices.” concludes the report.

Below a comment provided by a Google spokesman to Security Affairs.

“The off-brand devices discovered to be BADBOX-infected were not Play Protect certified Android devices. If a device isn’t Play Protect certified, Google doesn’t have a record of security and compatibility test results. Play Protect certified Android devices undergo extensive testing to ensure quality and user safety. To help you confirm whether or not a device is built with Android TV OS and Play Protect certified, our Android TV website provides the most up-to-date list of partners. You can also take these steps to check if your device is Play Protect certified.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Android)