The app installed like any other, and it had no icon, no screen, nothing a driver could open. That was the detail that made Kaspersky look twice. Following it back, its researchers found a multi-stage downloader that had reached Android car head units through the firmware updater built into them, and enrolled those dashboards into a botnet rented out for profit.
Kaspersky says it is the first documented case of malware on a car head unit with an infection chain specific to that type of device. The work was published by Dmitry Kalinin of Kaspersky, who attributes it with high confidence to MoYu Group, an actor linked to the BADBOX botnet platform.
Why a criminal would bother with your dashboard
A head unit holds almost nothing worth stealing. The value is not the data, it is the connection. These units often ship with their own SIM slot, which leaves each one permanently online on a consumer connection. Gather enough and you can sell access to that traffic. The same economics drive attacks on cheap streaming hardware, including the Android TV box botnet that learned to imitate real browser traffic this month.
The updater was the delivery van
The units run firmware from DoFun, which carries a legitimate system app called TWCore that handles analytics and updates. A message broker on the subdomain cardoor[.]cn tells TWCore which packages to install, and that instruction carries a flag named installNotExists which, when set, lets TWCore install software that was never on the device. Kaspersky found the malware in TWCore's own download directory, and in every case its telemetry recorded, the installer was TWCore itself. Kaspersky notified the vendor, which subsequently reported fixing the security issues.
Three stages, ending in a rented connection
A dropper called JarService unpacks code from XOR-encrypted blocks, then a second stage pulls down the payload that does the work. That payload checks in roughly every 90 minutes, reporting the device model, MAC address and the car's Wi-Fi network name. It supports nine commands, though the operators used only two. The important one delivers a reverse proxy module called zhima, turning the head unit into a relay for somebody else's traffic. Nokia Deepfield's Emergency Response Team found the same module on TV set-top boxes at around the same time.
A thread name gave the operators away
The attribution turns on something small. The second stage spawned a thread named mosdk-host-loader, and chasing that fragment led Kaspersky to an app on TV set-top boxes carrying a component called AdmoyuService. That is MoYu, tied to the BADBOX platform documented by researchers at HUMAN, and infrastructure overlap found independently by Nokia Deepfield pointed the same way. The commercial end is barely concealed: one zhima control server also answers for the operators' login panel, whose terms of use are served from a residential proxy vendor.
Check the network, because you cannot check the dashboard
DoFun has reported fixing the distribution problem, but Kaspersky did not publish a patched firmware version, and a head unit is not a device most owners can inspect. The network is the practical place to look. Kaspersky detects the proxy component as HEUR:Trojan-Proxy.AndroidOS.Zhima.
- Payload host: 144[.]217[.]243[.]201
- Control servers: t2[.]nmnsny[.]sbs, a2[.]nmnsny[.]sbs
- zhima proxy servers: 107[.]151[.]248[.]132, 128[.]14[.]210[.]58
- zhima module MD5: de77c3303e93c9450424759f1741441c
Nothing in the malware is exotic. It is commodity adware plumbing of the sort that has landed on cheap Android hardware for years, and the novelty is the address it arrived at. A modern head unit is a general purpose Android computer bolted to a dashboard, permanently online, updated over a channel its owner never sees. Vehicle security research usually asks what an attacker can make a car do, as with the car alarm flaw that let attackers unlock vehicles. This is a reminder that a car can be worth attacking for reasons unconnected to driving it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.