Mining Malware Hits Amazon’s Fire TVs

Cryptovest

Published Jun 13, 2018 04:59AM ET

Mining Malware Hits Amazon’s Fire TVs

If your Amazon (NASDAQ:AMZN) Fire TV suddenly stops playing video and acts sluggishly, you might actually be experiencing the effects of something called ADB.Miner . Transforming television sets into mining equipment for the hacker’s wallet, the virus first makes its presence known by revealing itself as a test application called “com.google.time.timer.”

The original discovery of this attack came from a user at the XDA Developers forum complaining about an app called “test,” which doesn’t have a presence in the app store, popping up and forcing the video to stop. At worst, the television suddenly crashes because it fails to process any input because its resources are then dedicated to mining cryptocurrency.

As with most malware mining varieties, this particular strain uses the Fire TV system to mine Monero through CoinHive by injecting the JavaScript code and running in the background. According to the experts who replied to the user, uninstalling won’t help unless the user disables Android Debug Bridge (ADB) on their device. In the worst-case scenario, the most effective way of removing the virus would be to restore the TV to factory settings and thus wiping all of its stored data.

This isn’t the first time we hear of ADB.Miner. A few months ago, it managed to spread to 5,000 Android smartphones in only 24 hours.

However, since Amazon Fire TV runs on Android, it was only a matter of time before the virus hit this type of device as well. Netlab’s discovery of the mining malware revealed that it scans devices for port 5555, typically used by Android’s system for debugging purposes.

This previous version of ADB.Miner would mine from the phone natively to two mining pools instead of using JavaScript. Efforts from mining pools to combat mining activity on Monero may have forced the hacker to change the code to work with CoinHive, which still doesn’t appear inclined to tackle this issue.


This article appeared first on Cryptovest