Android TV boxes under malware attack: the details and how to know if your device is at risk

Android.Vo1d is a new malware that has already infected nearly 1.3 million Android TV boxes in 197 countries. The malware embeds itself in the system’s storage area, creating a backdoor that allows it to download and install third-party software remotely at the command of an attacker. The origin of the malware is currently unknown, but researchers suspect that it may have come from an unofficial firmware with built-in root access. In all cases, the malware exploits a vulnerability in Android to gain root privileges. Affected devices include the R4 TV Box with Android 7.1.2 (Build NHG47K), the KJ-SMART4KVIP with Android 10.1 (Build NHG47K), and the TV Box models with Android 12.1 (Build NHG47K). In all of these cases, the Android versions are outdated and potentially contain unpatched security vulnerabilities that make them vulnerable to malware attacks. Android versions 7.1, 10.1 and 12.1 were released in 2016, 2019 and 2022 respectively. Remember that Android TV was updated to Android version 14 on May 15 of this year. Be careful though, because Google has stated that only devices that are not Play Protect certified seem to be at risk: in the next chapter we will see how to check if yours is at risk.

How to check if your Android TV box is at risk? The Vo1d malware has been detected in almost every country in the world, including Brazil, Morocco, Pakistan, Saudi Arabia, Russia, Argentina, Ecuador, Tunisia, Malaysia, Algeria, and Indonesia. Brazil is the hardest-hit country, with around 28% of infected devices reportedly being used in the country. But how do you know if your device is at risk of infection? Google clarified that the malware only infects devices running the Android Open Source Project (AOSP) version and not the proprietary Android TV, and that none of the affected devices are Play Protect certified, meaning they haven’t undergone security and compatibility testing designed to ensure quality and user safety. Play Protect is a Google service that runs security checks on apps before they’re downloaded from the Play Store and scans devices for potential malware from third-party app stores and installed APK files. If malicious apps are detected, Play Protect disables them and alerts you. Additionally, it can prevent the installation of unverified apps, especially those that request permissions on sensitive devices that are commonly targeted by fraudsters to commit fraud.

But how do you check if your Android TV box is certified? First, you can go to the Android TV website which displays the list of Google partner devices. Scroll down and click on Discover international Android TV partners . To check if Play Protect is available on your device, open the Play Store and click on your profile icon at the top right. Then select Settings and select Information: here you will find the writing Play Protect Certificate .