In this podcast, the speakers discuss the infiltration of Triada malware in Android devices through the hardware supply chain. They explore an ad fraud scheme called Peach Pit and its use of compromised devices. The podcast also covers efforts to disrupt the malicious operation and speculates on new attack vectors in ad fraud. Additionally, the speakers trace the origin of the infected devices back to China and uncover a potential collaboration between manufacturers and operators.
40:36
AI Summary
AI Chapters
Episode notes
auto_awesome
Podcast summary created with Snipd AI
Quick takeaways
Triada malware was being pre-installed on Android devices along the supply chain by various vendors and manufacturers, leading Google to implement stricter security measures.
The Peach Pit ad fraud scheme involved infected Android devices, like the T95 set-top boxes, which were widely available from online retailers and contributed to a widespread compromise.
Deep dives
Google's battle against Triada malware
Google had been combating Triada, a malware that compromised Android devices for ad fraud purposes. Triada was being pre-installed on devices along the supply chain by various vendors and manufacturers. Google made efforts to root out Triada and implemented stricter security measures, leading to certified Android devices becoming safer. However, some Android TV boxes, like the T95, remained vulnerable to Triada. Human researchers discovered the Peach Pit ad fraud scheme, which involved infected Android devices and apps. Over 200 device models were estimated to be affected globally.
The compromise of T95 set-top boxes
The T95 set-top boxes, widely available from online retailers, were identified as carriers of Triada malware. These devices were off-brand and Android-based, making them susceptible to pre-installation of the malware along the supply chain. Users purchasing the compromised devices were unaware of the infection, which allowed Triada to conduct ad fraud in the background. The popularity of these devices and their ease of access contributed to the widespread compromise.
The operation of Peach Pit ad fraud
Peach Pit, a module downloaded by Triada-infected devices, facilitated ad fraud activities. It engaged in activities like hidden advertisements, spoofed traffic, and malvertising. Peach Pit aimed to deceive ad networks and generate fraudulent monetized traffic. While some Peach Pit apps were identified and removed from Google Play Store and Apple's App Store, other Android and iOS devices voluntarily downloading these apps could still contribute to the ad fraud scheme.
Efforts to disrupt the operation
Human researchers, in collaboration with Google and Apple, worked to disrupt the Peach Pit ad fraud scheme. Invalid traffic generated by Peach Pit apps was blocked, and the identified apps were reported and taken down from both app stores. While direct takedown of Badbox was challenging, steps were taken to create awareness and encourage actions against the resale of infected TV boxes by retailers and government bodies. Ongoing collaboration with industry partners aimed to address the threat and potential vulnerabilities in IoT devices.
You can find all kinds of great deals on Android streaming TV boxes online. But sometimes something else comes in the box along with it. Our conversation with Lindsay Kaye - Vice President of Threat Intelligence at Human, and part of the security team that discovered that somewhere along the supply chain something else was getting installed into all kinds of Android devices.