Cheap Streaming Boxes May Compromise Home Internet Security

Millions of inexpensive Android-based streaming boxes may be secretly routing internet traffic for fraudulent activities and cybercrimes, according to security researchers.

These devices are reportedly part of a sprawling botnet known as Popa, which functions more as a persistent tunneling system than a traditional botnet designed for rapid attacks. The system registers devices and maintains encrypted connections, allowing external traffic to appear as if it originates from the user's home internet connection. This practice, known as using residential proxies, can mask illicit activities such as mass data scraping, account takeovers, and ad fraud.

The Popa Botnet and Residential Proxies

The Popa botnet is linked to the broader BADBOX and Vo1d ecosystems, which involve compromised Android-based streaming devices often sold under various unofficial brand names online. These devices frequently promise access to premium content like paid movies or live sports for a one-time fee, a common warning sign of potentially compromised hardware.

Lumen's Black Lotus Labs reported that Popa handles between 1.5 million and 2.5 million distinct IP addresses daily. Google previously indicated that the BADBOX 2.0 campaign compromised over 10 million uncertified Android devices, which were then used for ad fraud and other digital crimes.

Smart TV Apps and Hidden Risks

The issue extends beyond cheap Android TV boxes. Research has identified that some legitimate smart TV applications may also contain hidden tools that share home internet connections with third-party companies. Spur, a proxy-tracking service, found such components in over 42% of LG webOS apps and more than 25% of Samsung Tizen apps it reviewed.

In response, Samsung stated that it has restricted new app registrations containing residential proxy functions and is working to remove existing apps with these components. A Samsung spokesperson assured that these SDKs cannot access personal information from the TV, such as account credentials or viewing history. However, the company is implementing stricter developer policies to ban residential proxy SDKs.

Identifying and Mitigating Risks

Security experts advise consumers to be cautious of several warning signs. Devices that promise free access to paid content, are advertised as "unlocked" or "fully loaded," require disabling Google Play Protect, or come from unknown brands are particularly suspect.

To protect home networks, users are recommended to avoid "fully loaded" streaming boxes, disconnect any suspicious devices, and verify Play Protect certification on Android devices. Installing apps only from official stores and deleting unused or suspicious smart TV apps is also crucial.

Furthermore, maintaining updated firmware for routers and streaming devices, regularly checking router connections for unknown devices, and changing passwords used on suspicious devices are essential security practices. Experts also suggest using a guest network for smart devices to isolate them from personal computers and phones. If a device is suspected of being compromised, a factory reset may not be sufficient, and replacing the device is often the safest course of action.

Users experiencing suspicious activity or receiving abuse notices related to their IP address are encouraged to report it to the FBI's Internet Crime Complaint Center (IC3.gov) and contact their internet service provider. The primary concern is that seemingly harmless devices can be exploited to abuse home internet connections without the user's knowledge.