EFF Discovers Corejava Malware Embedded in Dragon Touch KidzPad Y88X 10 Devices
Researchers from the Electronic Frontier Foundation (EFF) have discovered that the firmware of the popular U.S.-based Dragon Touch KidzPad Y88X 10 devices has been embedded with several malicious programs, significantly compromising both the device’s and its users’ security.
The primary concern for the experts was the Corejava malware found in the tablet’s firmware. Alongside this, the tablet was also found to host several pre-installed applications with a high degree of risk, as well as an outdated parental control system, KIDOZ.
Dragon Touch KidzPad Y88X 10
Retailers like Amazon have played a significant role in popularizing affordable Android devices for children. However, EFF’s investigation has shown that sometimes the cost savings are not worth it, and it may be a wiser decision to opt for devices from established brands.
It’s noteworthy that devices under Amazon’s umbrella have been regularly criticized for containing pre-installed malware. In January 2023, the company drew public attention for selling the T95 TV box with built-in malicious software in its firmware.
Despite awareness of the issue, Amazon continued to sell these compromised devices until February 2023. In both cases, the same Corejava malware was detected.
Furthermore, EFF researchers noted a connection between the sellers of the malicious Android TV boxes and the Dragon Touch tablet. Several brands were registered at the same address as the tablet on Walmart’s website, suggesting that all devices sold by this vendor require thorough scrutiny.
Regarding the aforementioned high-risk programs, the tablet in question also had the Adups program pre-installed. This program is necessary for firmware updates but was found to contain malicious code.
What further alarmed the researchers was the embedded Kids Paint FREE app, which transmits the tablet’s exact GPS coordinates to an advertising server, raising concerns about the child’s actual physical safety.
It is important to note that malware built directly into an Android device’s firmware cannot be fully removed without Root privileges. Obtaining these privileges, in turn, introduces certain changes to the device’s interaction.
The case with the Dragon Touch children’s tablet vividly demonstrates that when choosing technology for children, one should not be guided solely by price or attractive design. Unknown brands, even if advertised by large companies or media personalities, can embed their devices with malicious programs, posing a real threat to the confidentiality and security of both children and their parents.
It is advisable to choose only devices from large and established manufacturers. Even then, after purchase, it is recommended to check the device for malware to eliminate any risks.
