Cheap Android TV Boxes Linked to Ad Fraud Operation, Researchers Find

Security researchers have uncovered an operation that allegedly uses inexpensive Android TV boxes to conduct ad fraud and disguise internet traffic, turning the devices into residential proxies. The operation, identified by security firm Bitsight and named the Fuyao Enterprise, targets devices that may appear to be legitimate but can secretly route outside traffic and click online advertisements.

Bitsight threat researcher Pedro Falé discovered the operation while examining security risks associated with cheap Android TV boxes. His team found an expired domain that previously managed factory backdoors on certain devices. After registering the domain, researchers observed that many connected boxes identified themselves as smartphones from brands like Samsung, Vivo, Huawei, and Xiaomi, despite their software indicating they were TV boxes.

Hidden Software on Certain Devices

Bitsight suggests that Fuyao apps may have arrived pre-installed on some Android TV boxes, specifically mentioning older H96 Max V11 devices. However, the available data is limited to older models that reported to the expired domain, and it does not confirm that all H96 devices are affected. The researchers noted that the software could have been added by an original equipment distributor, reseller, or custom firmware provider before the boxes reached consumers.

A Google spokesperson clarified that the affected devices are Android Open Source Project (AOSP) devices, not official Android TV OS devices or Play Protect certified devices. Google does not maintain security and compatibility test results for devices that are not Play Protect certified.

How the Ad Fraud Works

The Fuyao software allegedly disguises a TV box as a smartphone and directs it to operator-controlled websites featuring AI-generated content. The box then views and clicks ads, appearing to advertising systems as a mobile user. Researchers mapped 144 websites linked to the operation, with the possibility of a larger network. Bitsight reported that the operators employed computer vision to help bots locate ads on changing webpage layouts and used a customized version of Google's Blockly programming tool to build and send fraud tasks.

Bitsight also observed that the boxes could switch between functions. When an HDMI signal indicated television viewing, the box often acted as a residential proxy, routing someone else's internet traffic. When the TV was off, it could shift to ad fraud activities. This could allow the box to route external internet traffic while a user watched television and then engage in ad clicking after the TV was turned off, preventing interference with streaming.

Residential Proxies and Scale of Operation

A residential proxy routes another person's online traffic through a home's legitimate internet connection, masking the user's true location. While proxies have legitimate uses, criminals can exploit them to conceal the origin of their activities. The FBI has previously warned that compromised streaming boxes and other connected devices can provide criminals access to residential proxy networks.

In a 24-hour period, Bitsight observed nearly 66,000 reports linked to approximately 38,000 unique MAC addresses that appeared to have the Fuyao apps. Based on these observed device identities, Bitsight estimated potential daily ad fraud revenue of about $47,500. The operation is attributed by Bitsight to Zhejiang Fengwo IoT Technology Co., Ltd., operating as Fengwo Group.

Avoiding Risky Devices

To mitigate risks, consumers are advised to purchase streaming devices from recognizable manufacturers that provide security updates and customer support. Checking for Google Play Protect certification on the device is also recommended. Users should avoid installing apps from unofficial marketplaces and be wary of setup instructions that ask to disable Google Play Protect.

If a device is suspected of being compromised, it should be disconnected from the network. A factory reset may not remove malware embedded in the firmware, and replacing the device might be the safest option. For enhanced security, connecting streaming boxes and other smart devices to a separate guest or IoT network is advised. Users should also monitor for unexplained internet activity and ensure strong security software is active on other connected devices. The FBI encourages reporting suspected compromised devices through the Internet Crime Complaint Center (IC3.gov).