Pandora Malware On Android TV: Safeguard Yourself Today

Wajahat Raja

September 21, 2023 - TuxCare expert team

Popular for media streaming, low-cost Android TV set-top boxes are facing a new threat: a form of the Mirai malware botnet, which has recently attacked millions of these devices. This Pandora malware on Android TV has been detected by Dr. Web’s antivirus team as an advanced version of the ‘Pandora’ backdoor, which first appeared in 2015. In this article, we’ll go through the specifics of the danger of this smart TV cybersecurity breach and offer helpful tips for securing your Android TV experience.

The Pandora Malware Emergence and Channels

The main targets of this malware campaign are low-cost Android TV boxes equipped with quad-core processors capable of conducting powerful Distributed Denial of Service (DDoS) attacks even with a small number of compromised devices, such as the Tanix TX6 TV Box, MX10 Pro 6K, and H96 MAX X3.

For securing your Android TV, the first step is to understand the initiation of this malware. It enters these devices through two main channels:

1. Malicious Firmware Updates

In this case, malicious firmware updates are either installed by device resellers or unwittingly downloaded by customers from websites promising unfettered media streaming or increased application compatibility. To ensure persistence, the malware embeds itself within ‘boot.img,’ a component critical to the Android system’s startup process.

2. Malicious Apps

The second distribution route is malicious apps that provide free or low-cost access to copyrighted TV shows and movies. These apps launch a covert ‘GoMediaService,’ which is scheduled to start automatically when the device boots. This service then launches the ‘gomediad.so’ program, which activates a number of files, including a command-line interpreter and the Pandora backdoor installation. Once activated, the backdoor connects to a Command and Control (C2) server, updates itself, and waits for commands from hostile operators.

Capabilities of the Pandora Malware On Android TV

The pandora malware attack has a variety of damaging features, such as the capacity to launch DDoS assaults through TCP and UDP protocols, produce SYN, ICMP, and DNS flood requests, establish reverse shells, and mount system partitions for modification. By sending precise commands to hacked devices, attackers can initiate or cease DDoS attacks, among other harmful operations.

The Perilous Journey of Low-Cost Android TV Boxes

Budget-friendly Android TV sets frequently have an uncertain path from producer to consumer. Because of this lack of openness, end users are uninformed of prospective firmware update security changes and the many intermediaries engaged in the distribution chain. Even cautious buyers who keep the original ROM and take caution while installing apps face the danger of smart TV malware threats.

Malware Prevention For Smart TVs

With the emergence of such threats, it has become extremely important that you take precautions against Android TV vulnerability. Consider the following measures:

Invest in Trusted Brands: Purchasing streaming devices from well-known and trusted brands such as Google Chromecast, Apple TV, NVIDIA Shield, Amazon Fire TV, and Roku Stick minimizes the chance of malware infection greatly.

Regular Updates: Make sure you install Android TV firmware updates in a timely manner. Check for manufacturer-provided updates on a regular basis and install them as soon as possible to patch vulnerabilities.

Avoid Untrustworthy Sources: Avoid downloading firmware upgrades or software from unverified websites, especially those that sell pirated content. When possible, stick to authoritative sources to avoid malware infection on smart TVs.

Use a trustworthy Antivirus to mitigate Android TV security risks: On your Android TV device, use a trustworthy antivirus program to identify and remove dangerous threats.

Conclusion

Finally, the Pandora malware poses a clear and present danger to cybersecurity for connected TVs, particularly those who choose low-cost devices with unknown origins.

Protecting Android TV from malware can be done by exercising caution, selecting reputable brands, using Android TV antivirus solutions, and remaining cautious against questionable sources. Keep yourself secure and enjoy uninterrupted streaming.

The sources for this piece include articles in Cybersecurity News and BleepingComputer.

Summary