Vo1d infections on Android TV boxes: how to protect your devices

Recently, the Russian software house Dr.Web highlighted an alarm affecting Android TV boxes: the Vo1d malware has compromised almost 1.3 million devices in as many as 197 countries. The distribution of infections is most concentrated in Brazil, which accounts for 28% of reported cases, followed by countries such as Morocco, Pakistan, Saudi Arabia, Argentina, Russia, Tunisia, Ecuador, Malaysia, Algeria, and Indonesia. This malware uses a backdoor to penetrate the storage memory, thus posing a considerable threat for any subsequent use for malicious purposes.

Technical details of the exploited vulnerability

Once in place, Vo1d is capable of stealthily downloading and installing third-party software, which increases the security risks for users exponentially. Although the affected devices are outdated versions of the Android operating system, the potential damage is still significant. Google promptly released a reassuring statement for users of Play Protect certified devices, highlighting that none of them were infected by the malware. Their certification involves rigorous security and quality tests, thus significantly reducing the likelihood of infection.

Devices at risk and preventive measures

Google also explained that the infected devices were not certified with Play Protect, highlighting the importance of certification to maintain a high level of security on Android devices. Most of the infections were found on systems that may be using unofficial versions of firmware or source code from the Android Open Source Project (AOSP). This finding underscores how crucial it is for users to always verify the certification of their device to avoid similar vulnerabilities.

Infected devices and Dr.Web interventions

The report by Dr.Web specifically mentions vulnerable Android TV box models such as KJ-SMART4KVIP (Android 10.1; KJ-SMART4KVIP Build/NHG47K), R4 (Android 7.1. 2; R4 Build/NHG47K) and TV BOX (Android 12.1; TV BOX Build/NHG47K). Dr.Web claims that its antivirus is effective in detecting and eliminating the Vo1d malware. The source of the infection remains unknown, although it is suspected that it may be related to previously discovered vulnerabilities that allow root access or the use of unofficial firmware with built-in root access. Continuous vigilance and preventive measures, such as using up-to-date antivirus software, are recommended to protect devices from such threats.