Botnet Warning: Budget Android TV Boxes Could Be Secretly Hijacking Your Internet
As spotted by KrebsOnSecurity and documented by Google, these "bad boxes" do often work as advertised, but also perform a number of shady background operations, like mining crypto, participating in advertising scams, participating in DDoS attacks, and other botnet behavior. Besides the blatant copyright violations associated with many of these devices, the existence of malware on your network could also expose other devices to potential risks, including ransomware. You do not want one of these "bad boxes" on the same network as your critical personal systems or devices.
What's worse is that these devices are still being widely sold at prominent retailers including Walmart and Best Buy. The most popular brand name at time of writing seems to be "Superbox", with KrebsOnSecurity pointing out their presence across Walmart, Best Buy, Amazon, and Newegg. There have been some limited crackdown efforts on Amazon, but the devices can still be found sold under other names, including a generic-sounding "modem and router combo" listing. The devices are so pervasive that Newegg even sells Spanish-language versions like the "SuperCaja" variations.
Be sure to avoid these devices and make sure your immediate family members or roommates aren't using them on your network. Putting your network at risk with these malware-infested TV boxes could cause a whole heap of trouble. Legitimate options aren't prohibitively expensive, with the popular NVIDIA Shield Android TV player selling for only $199.99. While it doesn't come with many built-in streaming applications, its legitimate support for streaming and gaming services makes it a great living room companion, especially for gaming PC owners with Steam Link or Moonlight installed. In our own 2015 review, we crowned it The Ultimate 4K Streamer, though there are many alternatives available on the market today.
