shinyhunters

2 Articles

This Week In Security: Android Malware, VOIP Hijack, Signal Contact Discovery, And TeamPCP Arrests

August 28, 2026 by 4 Comments

On GitHub, [AyaanB] details buying a cheap Android TV streaming device, looking for, and finding, baked-in malware.

Multiple warnings have been issued by the FBI and CISA regarding malware on media box Android devices. Many devices have been caught participating in botnets providing residential proxies, ad-click fraud, and DDOS services. [AyaanB] sets out to discover if a $30 set-top streaming box is pre-infected with malware, and extracting it – without ever letting the device talk to the Internet or access other devices on the local network.

Picking a device named in the advisories, [AyaanB] discovered that it was, indeed, preloaded with multiple app stores and applications that wouldn’t typically make sense on a set-top TV box. After identifying the serial port test pads and obtaining a low-voltage serial adapter, they were able to gain access to the bootloader and from there dump the contents of the MMC over TFTP.

With the entire filesystem accessible out-of-body, proving it was infected with malware at the factory becomes simple: the malware is signed as a system application, baked onto the system partition of the MMC, granted SELinux exceptions to mark it as a system binary with shell privileges, and has multiple launch scripts to make sure it is executed even if partially removed. With the malware identified, [AyaanB] continues to dig through to uncover the capabilities.

By installing hooks into the low-level Android process spawning system, the malware installs hooks into every application as it is launched: even if an application isn’t trojaned already, by the time it finishes executing, it’s definitely been subverted. The functions patched and the methods used match the Vo1d botnet, which is used for account takeovers, residential proxies, free “VPN” services, and other unfriendly behavior.

Further digging into the system showed hooks for ad-click fraud, where hidden browser windows are allowed to run unthrottled and display overlays are configured to obscure ads below where the user may click. Other included tools bid in real-time ad auctions, claiming to directly publish ads to the user which may or may not be visible. To cap it all off, a root level backdoor allows botnet operators to access the systems directly and install additional tools.

Be sure to check out [AyaanB]’s writeup for more details on exfiltration methods and other malware found on the devices. Continue reading “This Week In Security: Android Malware, VOIP Hijack, Signal Contact Discovery, And TeamPCP Arrests” →

This Week In Security: Another Linux Exploit, Ubuntu Knocked Offline, Finals Interrupted, And Backdoored Tools

May 8, 2026 by 15 Comments

After the CopyFail vulnerability gave root access from any user on almost all distributions last week, this week we’ve got DirtyFrag. This chains the vulnerability in CopyFail (xfrm-ESP) and a new vulnerability in a RPC function which allows similar overwriting of the page cache.

Both vulnerabilities manipulate the Linux page cache where data from disk is stored for rapid access. The kernel will always prefer the cached version of a file, which means that anything that is able to manipulate the contents of the cache can effectively replace the contents of the file. Both of the vulnerabilities leverage a similar mechanism – picking a binary which is flagged to run as root, such as su, and replacing the contents that would prompt for the users password with a launcher to immediately run a shell.

Like CopyFail, DirtyFrag requires the ability to execute code on the target in the first place, but turning almost any code or command execution vulnerability in any network service into root raises the impact significantly, allowing an attacker to break out of containers and privilege environments, or establish a persistent presence in the system when the original vulnerabilities are discovered and closed.

The previous mitigations to block specific kernel modules related to CopyFail are not sufficient to block the new vulnerabilities. At the time of writing this, there are no available patches from the distributions, however the vulnerable kernel modules can be temporarily disabled.

CopyFail added to KEV

CISA (the United States cyber security agency) has added CopyFail to the KEV, or Known Exploited Vulnerabilities list. Attacks on the KEV have been observed under active exploitation, which in the case of CopyFail is hardly a surprise.

The KEV is designed as a tool to allow security teams in government and commercial industry to prioritize the highest risk vulnerabilities – or at least give another source of data to point at when you say “we really need to patch this now”.

Prolonged Ubuntu DDOS

On the heels of the CopyFail vulnerability impacting almost all distributions, Ubuntu has had to face a prolonged distributed denial-of-service (DDoS) attack against the main infrastructure. Ars Technica reported at the beginning of the attack, and after several days, services appear to be restored. In the meantime, core services such as package updates, core repositories, and even the Ubuntu and Canonical websites were largely unreachable.

An Iraqi group claims responsibility for the attack, but it is unclear if they were the actual perpetrators – or why. The timing with the CopyFail vulnerability seems like an opportune moment to cause chaos by taking the update mechanisms of a major distribution offline, but in the era of modern Internet behavior, it could also just have been a Tuesday.

Continue reading “This Week In Security: Another Linux Exploit, Ubuntu Knocked Offline, Finals Interrupted, And Backdoored Tools” →