10mo ago

1.3 million Android-based TV boxes backdoored; researchers still don’t know how

arstechnica.com

Infection corrals devices running AOSP-based firmware into a botnet.

Android @lemdro.id

Nemeski @lemm.ee

10mo ago

1.3 million Android-based TV boxes backdoored; researchers still don’t know how

arstechnica.com /security/2024/09/researchers-still-dont-know-how-1-3-million-android-streaming-boxes-were-backdoored/

11 comments

Gee, I bought this cheap made in China Android TV thing off Ali express, and I just can’t figure out how this backdoor got in here…
- Oop.. They got my printer now.
  
  And my axe!
RethinkDNS (available on F-Droid) has a mode where it blocks every connection by default and you have to allow each app to access the network. I used that to effectively disable the pre-installed malware on my Android TV box (X88 Pro iirc). It also has DNS and connection logs to check network traffic (can be a lot though). GlassWire (Play Store) is nice to quickly check for an unexpected amount of network traffic. Not sure if there's ways around that, but it worked in my case a while ago.
- These tools look amazing. Thanks for sharing.
  Here's a link for those interested: https://rethinkdns.com/
- The logs are searchable by app, IP , and domain, so that helps a lot.
I have a MiBox, I wonder if its vulnerable
- I'm guessing very few, if any, Play Store certified devices are on that list. Unless Google has really laxed requirements.
  Either way, Xaomi devices might get a CCP backdoor, but probably not an ordinary botnet like this.
  
  So no talking about how awesome Taiwan is near my tv huh
Further, while only licensed device makers are permitted to modify Google’s AndroidTV, any device maker is free to make changes to open source versions. That leaves open the possibility that the devices were infected in the supply chain and were already compromised by the time they were purchased by the end user.
It's ArsTechnica, so I wouldn't think they're intentionally spreading FUD around FOSS, but that bit did live a bad taste in my mouth.

11 comments