No CVE required: DoFun head units installed whatever their MQTT update broker sent

Nothing in the chain had to break. A broker topic that accepts an instruction to install a package, plus a parameter named `installNotExists` that permits packages the device has never held, is remote code execution offered as a product feature ^[3]. JarService needed no root and no privilege escalation; Kaspersky records it going on as an ordinary user application ^[11]. Hardening the Android build underneath would have changed nothing, because the privilege the attackers used was the one the vendor had already granted its own updater ^[2].

The forensic artefact makes the point better than an advisory could. Kaspersky's advice for finding an infected unit is to look for unknown APKs in the TWCore cache directory with `com.tw.core` recorded as the installer ^[13]. The install record correctly names the vendor's software as responsible, because it was. Any control that treats installer provenance as a trust signal reads this as a legitimate update, and in the narrow sense it is one.

The traffic is not subtle. A 90-minute default beacon interval ^[7] is 16 check-ins per device per day ^[1], around 480 a month ^[2], each carrying device model, screen resolution, connected Wi-Fi SSID and MAC address ^[7]. That is a metronome on any link somebody is watching, and every mitigation Kaspersky lists sits away from the device: signature verification and allowlists on update instructions and APKs at the vendor ^[15], and blocking C2 and zhima traffic at the perimeter before the implant can collect its modules ^[16].

The reassurance in the report deserves reading slowly. Kaspersky has not observed interference with driving operations or critical vehicle controls ^[18]. It also says head units usually fall outside enterprise EDR, making direct visibility into APKs, processes and C2 traffic unlikely ^[14]. Absence of observation on a platform nobody can observe is thin evidence, and here it is the only kind available.

DoFun has reported to Kaspersky that the issue is resolved ^[12], while the method used to get malicious install instructions into the legitimate channel is not public ^[17]. A buyer therefore cannot tell an authenticated broker with signed payloads from a rotated credential on the same open path, and those are not the same repair. Related Kaspersky reporting ties the zhima proxy to the MoYu Group and describes it running on a television as well as on car dashboards ^[19]. The defect belongs to the update channel, and update channels ship on everything.