Memorandum
- From
- Delaney Sawyer via Blog – Hackaday
- Date
- Filed
- News·5 min to read
- Re
Security Roundup: Pre-Infected Android TV Boxes, DNS Call Hijacking, and Browser Fingerprinting
ReSecurity Roundup: Pre-Infected Android TV Boxes, DNS Call Hijacking, and Browser Fingerprinting
This week's security news covers malware found baked into cheap Android TV streaming devices, a researcher who accidentally positioned themselves to intercept phone calls to military bases by registering expired domains, and AliExpress's use of hidden audio fingerprinting to track users.
Security researchers this week detailed how inexpensive Android TV streaming boxes can arrive with malware already baked into the system at the factory, how an abandoned telephone routing standard left calls to military bases open to interception, and how AliExpress has been using hidden audio fingerprinting to identify users.
On GitHub, a researcher known as AyaanB documented the process of buying a $30 set-top streaming box, identifying the malware preloaded on it, and extracting it without ever letting the device connect to the internet or access other devices on the local network. The FBI and CISA have issued multiple warnings about malware on media box Android devices, many of which have been caught participating in botnets providing residential proxies, ad-click fraud, and DDoS services.
AyaanB picked a device named in the advisories and discovered it was preloaded with multiple app stores and applications that would not typically make sense on a set-top TV box. By identifying the serial port test pads and obtaining a low-voltage serial adapter, they gained access to the bootloader and dumped the contents of the MMC over TFTP. The malware was signed as a system application, baked onto the system partition, granted SELinux exceptions to mark it as a system binary with shell privileges, and had multiple launch scripts to ensure it executed even if partially removed.
The malware installs hooks into every application as it is launched, subverting apps that were not already trojaned. The functions patched and methods used match the Vo1d botnet, which is used for account takeovers, residential proxies, free VPN services, and other unfriendly behavior. Further digging showed hooks for ad-click fraud, where hidden browser windows run unthrottled and display overlays obscure ads below where the user may click. Other tools bid in real-time ad auctions, claiming to directly publish ads to the user. A root level backdoor allows botnet operators to access the systems directly and install additional tools.
In a separate story, a researcher known as Lina wrote about accidentally positioning themselves to intercept phone calls by registering an expired domain. In the early 2000s, a domain name scheme was developed to directly map telephone numbers to DNS records for SIP and VOIP calling. The e164-arpa number to name scheme was never widely adopted and quickly forgotten, and the infrastructure slowly fell apart.
Lina noticed that several country records were delegated to name servers hosted in expired domains. For a five Euro registration fee, they gained control over an abandoned DNS resolution protocol for Saint Helena, Diego Garcia, and Ascension Island. After watching the logs for some time without getting traffic, the project was shelved. Six months later, Lina examined the logs of the other domains and found hundreds of thousands of records of attempted calls, many of them headed to military bases. Because the DNS records control the destination of the call, it would have been possible to hijack all the calls transparently and mine them for information. The domains were eventually transferred to the National Cyber Security Center in the UK.
Finally, AliExpress has been caught using a hidden fingerprinting technique to try to identify users. The fingerprinting plays a waveform in the background of the page with the volume set to zero and measures variances in the computed values. Variances are introduced by the browser type, CPU, audio hardware, and even driver versions. AliExpress also used other fingerprinting techniques, including WebGL, WebRTC, and screen resolution, to build profiles of each browser. The purpose is unknown, but it could be used for fraud prevention or to identify and track customers who have disabled traditional tracking cookies. The audio fingerprinting was discovered when a user experienced trouble with Bluetooth headphones being attached to the silent audio stream.
