(Credit: trucic via Getty Images)
Malware known as a "BadBox 2.0" has infiltrated over 10 million Android devices, including TV streaming devices, tablets, and digital projectors, according to Google.
On Thursday, Google said it filed a lawsuit in New York to try and shut down the "criminal enterprise," which operates as a botnet or an army of infected devices.
"This botnet—called the 'BadBox 2.0' botnet—is already the largest known botnet of internet-connected TV devices, and it grows each day,” Google said in a court document. “Without warning, it could be used to commit more dangerous cybercrimes, such as ransomware or distributed denial-of-service (‘DDoS’) attacks.”
Security researchers initially reported the threat in March. The FBI then warned the public about BadBox 2.0 last month. But at the time, the agency said the malware had infected “millions” of devices without specifying an exact number.
(Credit: Google)The threat is spreading via low-cost, no-name Android devices manufactured in China. In some cases, the malware will be preinstalled. In others, BadBox will download as Trojanized apps during the setup process through unofficial app stores. Hackers can then sell access to the infected devices to other cybercriminals, giving them a launching pad to conduct hacking activities in the US and other countries.
Google’s lawsuit identifies some of the affected product models, including Android TV boxes with model numbers X88 Pro 10, T95, MXQ Pro, and QPLOVE Q9. (Human Security also published a more comprehensive list.)
The malware exploits Android by compromising devices running the open-source version of the OS, “which lacks Google’s security protections,” the company wrote in Thursday’s blog post.
Google’s lawsuit alleges the hackers behind BadBox 2.0 are based in China and include at least 25 individuals or entities. Although the hackers' identities are unknown, the company is requesting that the New York court grant it the legal power to help it shut down the botnet. This includes asking the judge for a "permanent injunction” to force any internet services tied to the BadBox malware to cease such operations.
The lawsuit lists dozens of internet domains operated by Cloudflare, GoDaddy, and NameCheap that Google has linked to the malware. This suggests Google wants to shut down the malware's command-and-control servers, thus disrupting the botnet.
In its blog post, Google added, "This lawsuit enables us to further dismantle the criminal operation behind the botnet, cutting off their ability to commit more crime and fraud.”
If you own one of the affected devices, consider pulling the plug. Google’s lawsuit notes that the BadBox malware can also work in the background to generate fraudulent clicks for mobile ads. "BadBox 2.0 is particularly dangerous not only due to its scale, but also its flexibility. The Enterprise designed its infrastructure to facilitate a wide variety of criminal schemes and fraudulent operations," the lawsuit adds.