News Summary

• On GitHub, [AyaanB] details buying a cheap Android TV streaming device, looking for, and finding, baked-in malware.
• The malware is signed as a system application, baked onto the system partition of the MMC, and has multiple launch scripts to make sure it is executed even if partially removed.
• By installing hooks into the low-level Android process spawning system, the malware installs hooks into every application as it is launched.
• Even if an application isn’t trojaned already, by the time it finishes executing, it’s definitely been subverted.