A malware known as a “BadBox 2.0” has spread to infiltrate over 10 million Android devices, including TV streaming devices, tablets and digital projectors, according to Google.
The good news is that Google is working to crack down on the threat, which operates as a botnet or an army of infected devices. On Thursday, the company revealed it’s filed a lawsuit in New York to try and shut down the “criminal enterprise.”
“This botnet —called the ‘BadBox 2.0’ botnet— is already the largest known botnet of internet-connected TV devices, and it grows each day,” Google said in a court document. “Without warning, it could be used to commit more dangerous cybercrimes, such as ransomware or distributed denial-of-service (‘DDoS’) attacks.”
Last month, the FBI also warned the public about BadBox 2.0 after security researchers initially reported the threat back in March. But at the time, the FBI said the malware had infected “millions” of devices without specifying an exact count.
(Google)
The threat is spreading via low-cost, no-name Android devices manufactured in China. In some cases, the malware will be preinstalled. In others, BadBox will download as Trojanized apps during the setup process through unofficial app stores. The hackers can then sell access to the infected devices to other cybercriminals, giving them a launching pad to conduct hacking activities in the US and other countries.
Google’s lawsuit identifies some of the affected product models, which include Android TV boxes with the model numbers X88 Pro 10, T95, MXQ Pro and QPLOVE Q9, among others. (Human Security has also published a more comprehensive list.)
The malware has been exploiting Android by compromising devices running the open-source version of the OS, “which lacks Google’s security protections,” the company wrote in Thursday’s blog post.
Google’s lawsuit alleges the hackers behind BadBox 2.0 are based in China and span at least 25 individuals or entities. Although the identities of the hackers remains unknown, the company is requesting the New York court grant it the legal power to help it shut down the botnet. This includes asking the judge for a “permanent injunction” to force any internet services tied to the BadBox malware to cease such operations.
Recommended by Our Editors
The lawsuit itself lists dozens of internet domains operated by Cloudflare, GoDaddy and NameCheap that Google has linked to the malware. This suggests Google wants to shut down the command-and-control servers for the malware, thus disrupting the botnet.
In the company’s blog post, Google added: “this lawsuit enables us to further dismantle the criminal operation behind the botnet, cutting off their ability to commit more crime and fraud.”
If you do own one of the affected devices, consider pulling the plug. Google’s lawsuit notes the BadBox malware can also work in the background to generate fraudulent clicks for mobile ads. “BadBox 2.0 is particularly dangerous not only due to its scale, but also its flexibility. The Enterprise designed its infrastructure to facilitate a wide variety of criminal schemes and fraudulent operations,” the lawsuit adds.
Get Our Best Stories!
Stay Safe With the Latest Security News and Updates
By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy.
Thanks for signing up!
Your subscription has been confirmed. Keep an eye on your inbox!
About Michael Kan
Senior Reporter
