Google and partners dismantle botnet of 1.3 million infected Android TV boxes

Google says it has worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes. According to Google, the devices ship with malicious software that secretly rents the owner's internet connection out to strangers and carries out advertising fraud. The takedown was reported by Krebs on Security.

Infected out of the box. The key detail is that the malware did not arrive through a suspicious download or a phishing link. According to the report, the boxes come with the malicious software already on board, so buyers had no obvious way to know their device was compromised when they plugged it in.

Your connection, rented out. The malware turns each box into a proxy, meaning strangers can route their own internet traffic through the owner's home connection without the owner's knowledge. On top of that, the infected devices were used to commit advertising fraud.

Bigger than TV boxes. Experts involved in the takedown say the action is likely to cut the botnet's access to more than 10 million additional compromised systems. These include other Internet of Things products, such as Android-based healthcare devices and karaoke machines.

Why it matters

Hidden risk at home. When a household device is used as a proxy, other people's activity appears to come from the owner's internet connection. Advertising fraud, meanwhile, drains money from businesses that pay for ads. The scale reported here shows how cheap connected gadgets can become infrastructure for criminals. Details beyond what Google and the experts have stated, such as who operated the botnet, were not included in the available summary.

• Buy streaming boxes and smart devices from reputable brands and sellers.
• Be cautious with unusually cheap, unbranded Android TV boxes.
• Keep connected devices updated and remove ones you no longer use.
• If your home connection behaves strangely, check which devices are on your network.

What to watch. It remains to be seen how quickly the operators try to rebuild, and whether affected device owners will receive guidance on cleaning or replacing their boxes.

Source: Krebs on Security