Cyber Security Threat Summary:
Retailers like Amazon have promoted affordable Android devices for children, such as the Dragon Touch KidzPad Y88X 10 tablet. However, research by the Electronic Frontier Foundation (EFF) revealed malware and riskware on the device, leading to Amazon removing it from the platform. Other Y88X models remain available. This is not the first instance; in January 2023, Amazon sold a T95 Android TV box with preinstalled malware. Both instances involved the Corejava malware.

Security Officer Comments:
The Android Open Source Project (AOSP) serves as the foundation for most Android devices, but customized versions may include undesired apps or malware. The Dragon Touch Tablet had the Corejava malware present in its firmware directories. Additionally, it had Adups, classified as malware, which persisted even after a factory reset.

Suggested Correction(s):
The tablet's KIDOZ app, despite being COPPA Certified, was outdated and repurposed, collecting and sending device-specific data. The app Kids Paint FREE raised privacy concerns by transmitting precise GPS coordinates to a nonexistent server. EFF emphasized the need for Amazon to address cybersecurity issues, particularly when children are the target.

Link(s):
https://www.hackread.com/dragon-touch-tablets-kids-corejava-malware/