Malware Hijacks Android Car Head Units
What Happened — Kaspersky researchers discovered a previously unknown Android‑based malware that silently installs via the official OTA update channel of automotive head units. The malicious app, delivered through the legitimate TWCore updater, turns compromised head units into proxy nodes for the BADBOX botnet used for ad‑fraud.
Why It Matters for Compliance & Audit Readiness
- This attack exploits a mis‑configured update pipeline, a classic control‑gap scenario that SOC 2’s Change Management (CC6.1) and System Operations (CC7.1) controls are designed to prevent and evidence.
- Continuous evidence collection of OTA update integrity (code‑signing, hash verification, install‑only‑if‑new checks) provides audit‑ready proof that the organization is actively managing the risk of unauthorized software on embedded devices.
Who Is Affected — Automotive manufacturers and Tier‑1 suppliers that ship Android‑based infotainment/head‑unit hardware; downstream fleet operators and connected‑car service providers.
Recommended Actions
- Review and harden OTA update processes: enforce mandatory code‑signing, integrity checks, and disable silent‑install flags.
- Map the OTA‑update workflow to SOC 2 change‑management controls and begin continuous logging of update events as audit evidence.
- Deploy endpoint‑integrity monitoring on head‑unit firmware to detect unauthorized installations.
Source: Security Affairs
Technical Notes
- Malware is delivered as a hidden APK via the TWCore system app, which uses an MQTT broker to fetch and install packages.
- The “installNotExists” flag, when set to true, bypasses the usual existence check, turning a routine firmware update into a silent installer.
- No CVE is cited; the issue stems from a configuration weakness in the OEM’s update mechanism.
Source: same as above