BSI of Germany Disrupts BADBOX Malware

BSI of Germany did a really good job.

Germany's Federal Office of Information Security (BSI) has announced that it has disrupted a malware operation called BADBOX that came preloaded on at least 30,000 internet-connected devices sold across the country.

Whether you shop online or in-store, choose your retailer wisely when buying smart TVs, mobile phones, or tablets

https://bit.ly/4gCMBIS

"...Impacted devices include digital picture frames, media players, and streamers, and likely phones and tablets."

'What all of these devices have in common is that they have outdated Android versions and were delivered with pre-installed malware,' the BSI said in a press release."

"Once connected to the internet, the malware embedded into the devices can collect a wide range of data such as authentication codes, and install additional malware."

"...'Anyone can accidentally buy a BADBOX device online without ever knowing it was fake, plugging it in, and unknowingly opening this backdoor malware.'

The BSI said that devices compromised by BADBOX are also capable of acting as a residential proxy service, allowing other threat actors to route their internet traffic through them while simultaneously evading detection. They could also be used to create online accounts on Gmail and WhatsApp."

"These off-brand devices discovered to be infected were not Play Protect certified Android devices. If a device isn't Play Protect certified, Google doesn’t have a record of security and compatibility test results. Play Protect certified Android devices undergo extensive testing to ensure quality and user safety..."

"Cybersecurity Bitsight, in an analysis published December 17, 2024, said it identified 192,000 BADBOX infected devices, citing telemetry data, with most of them traced back to Yandex 4K QLED TV and T963 Hisense smartphone. The top affected countries are Russia, China, India, Belarus, Brazil, and Ukraine."

About 17,000 Unpatched Microsoft Exchange Servers in Germany

If you are living in Germany and administering some Exchange Servers then you can begin to worry.

The German Fededal Office for Information Security (Bundesamt für Sicherheit in der Informationtechnik - BSI) has identified a critical security concern about the poor state of Microsoft Exchange server patching in the country.

Of these servers in Germany, 12% are running a version which is no longer supported (such as Exchange 2010 or 2013) and around 25% are running Exchange 2016 or 2019 without vital patches. This means that at least 37% of Microsoft Exchange Servers in Germany are vulnerable to cyber attacks.

And this case shows us how vital are vulnerability and patch management systems for a company.

https://bit.ly/3THFk0K

"The government regulator says there are 17,000 or more Exchange Server instances in Germany vulnerable to at least one critical vulnerability, out of around 45,000 public-facing servers in the Euro nation running the software."

"Of particular concern is fixing CVE-2024-21410, an elevation-of-privilege vulnerability that Microsoft patched last month. According to German investigators, it's not clear whether as much as 48 percent or so of the country's Exchange servers have fixed up this hole yet, and Microsoft did warn it's a trickier-than-normal update to apply."

"We're told BSI is now emailing network providers on a daily basis reminding them to shore up any vulnerable system it detects. It warns that criminals are already on the lookout to exploit these reported flaws and 'schools and universities, clinics, doctors' practices, nursing services and other medical facilities, lawyers and tax advisors, local governments and many medium-sized companies are particularly affected.'"