With the end to the festive season, a lot of homes are now quipped with smart gadgets, making people lazier than ever. Out of all the new gadgets that rolled out on the streets, one of the most popular choices were smart TVs. Having access to Android apps and functioning as well as to any other Android device, these TVs are a hit in the market as they provide the high resolution experience with the beloved Android interface. However, these devices have their own vulnerabilities to malwares.
These TVs have abilities that a normal TV doesn't have access to. These smart TVs can use certain apps that allow users to watch channels from other parts of the world (that would otherwise be unavailable via other methods) . However, some of these apps may put users at risk. These apps contain a backdoor that abuses an old flaw (CVE-2014-7911) in Android versions before Lollipop 5.0 (Cupcake 1.5 to Kitkat 4.4W.2). (We detect these malicious apps as ANDROIDOS_ROOTSTV.A.) Most smart TVs today use older versions of Android, which still contain this flaw. In addition, other Android devices with older versions installed are also at risk: it just happens to be that these kinds of apps are mainly used in smart TVs or smart TV boxes. The sites that distribute these malicious apps are located at the following URLs. These sites are under the H.TV name, with most visitors located in the United States or Canada.
To successfully distribute the malware, attackers lure users to websites that distribute it and get them to install the applications that are infected with the backdoor. As soon as the malicious applications have been installed, the attacker triggers the vulnerability in the system and use well-known exploit techniques like heap sprays or return-oriented programming to gain elevated privileges in the system.
Samsung had recently launched the three tiered security solution for its latest Tizen-based Smart TVs. According to the company's statement, this service is meant to give its consumers access to the necessary protection across the Smart TV ecosystem, covering both software and hardware.