First Malware Built Specifically for Car Head Units Fuels Botnet

Kaspersky researchers discovered malware specifically crafted for car head units running Android, linked to the BadBox botnet. The malware exploits a vulnerability in the software update system of DoFun's aftermarket infotainment units, allowing attackers to deliver stealthy malicious apps that function as droppers, loaders, clickers, and reverse-proxy loaders. The malware supports nine commands, with observed activity focused on downloading a reverse proxy module to integrate infected devices into a proxy botnet. The vendor patched the vulnerability following disclosure. The BadBox botnet, active since 2023 and previously targeting Android TV boxes, has expanded its infection vector to vehicle infotainment systems, reflecting an evolution in its operational scope.

The malware enables attackers to incorporate infected car head units into the BadBox proxy botnet, potentially facilitating ad fraud and proxy-based malicious activities. Millions of devices have been compromised by BadBox, indicating a large-scale threat. The infection of vehicle infotainment systems represents a new attack surface, potentially increasing the botnet's reach and capabilities. However, there is no indication from the data that the malware directly impacts vehicle safety or control systems. The vendor has remediated the exploited vulnerability, reducing the risk of further infections via this vector.

The vendor has addressed the vulnerability in the software update system of the affected infotainment units following notification. Users should ensure their devices are updated with the latest firmware provided by the vendor. Since the malware relies on exploiting the update mechanism, applying the official patch mitigates this threat. No additional mitigation actions are specified or required according to the vendor advisory.