The supply-chain surprise

Heads up: some Android-based car head units have been quietly recruited into a shady network. A legitimate-looking system update app on certain head units was found dropping a stealthy APK that installs a backdoor. The affected units come from a vendor called DoFun, which supplies generic Android infotainment hardware and software for cars.

Security researchers traced the infection to an app called JarService (yes, the name sounds boring on purpose). It doesn’t show up in the UI; instead it decrypts and launches a second-stage loader that phones home to a command server and pulls down another encrypted payload. This is classic supply-chain skulduggery — a trusted component being used as a delivery vehicle for malware.

Inside the malware — what it does and why it’s nasty

The final payload quietly gathers basic device details (model, screen resolution, Wi‑Fi SSID, MAC address, etc.) and waits for orders. The researchers noted the operators mostly deploy a reverse-proxy module called ‘zhima’ that turns these head units into nodes in a proxy botnet. In other cases the devices are used to generate fake web traffic and clicks, i.e. advertising fraud.

The malicious code supports a handful of remote commands. Here’s a simplified rundown of the capabilities the attackers can trigger:

  • return — read a stored value from the device’s preferences
  • copy — place stored or downloaded content into the clipboard
  • http — perform HTTP GET/POST requests and optionally save parts of the response
  • web — open a URL inside an embedded web view and run injected JavaScript
  • loadlib — stubbed / not fully implemented in the samples analyzed
  • loadlib2 — download and execute extra modules or arbitrary code
  • loadlib3 — another partially implemented loader call
  • deeplink — open a specified resource in the default browser
  • traceroute — check network reachability to hosts via ICMP ping

Importantly, the malware doesn’t appear to tamper with driving controls or interfere with vehicle safety systems — it’s focused on turning internet-connected head units into monetized infrastructure rather than causing physical harm.

Researchers notified the vendor about the issue; the vendor reported the problem was addressed. If you own an affected head unit, check for official updates from the device maker, avoid installing apps from unknown sources, and consider having the unit professionally inspected if you spot odd network activity.