Bitsight researchers have reported a campaign, dubbed "Fuyao," involving inexpensive Android TV boxes that are pre-loaded with malicious applications. These applications reportedly alter the devices' hardware identities to impersonate popular smartphone brands such as Samsung, Huawei, Xiaomi, and Vivo. The primary reported function of these altered devices is to engage in ad clicking on websites controlled by the same operators. The research attributes this operation to Zhejiang Fengwo IoT Technology Co., Ltd., a company based in mainland China and established in 2019.
Beyond the ad-clicking scheme, the researchers also detailed a secondary, more significant function of these pre-installed applications. These apps are said to leverage the Android TV boxes to transform the owners' broadband connections into proxy nodes. This means that the compromised devices are being used to route traffic for third parties, effectively turning the owners' internet service into an unwitting part of a larger network.
The mechanism behind the identity spoofing likely involves manipulating system properties or firmware settings that report device identifiers. By mimicking well-known smartphone manufacturers, the operators may be attempting to evade detection by ad networks or other security mechanisms that might flag unusual device types or traffic patterns. This class of identity spoofing is a common tactic in ad fraud to blend in with legitimate user traffic.
The proxy functionality is particularly concerning. When a device is co-opted into a proxy network, its IP address is used by others to access the internet. This can have several implications for the device owner, including potential legal liability if the proxy is used for illicit activities, increased bandwidth consumption, and a degradation of internet service performance. This type of abuse often relies on exploiting permissions granted to pre-installed applications or vulnerabilities in the device's operating system to establish persistent network connections and route traffic.
Affected products are described as "cheap Android TV boxes," suggesting a target demographic that may be less likely to scrutinize pre-installed software or have the technical means to detect and mitigate such issues. These devices typically run a customized version of the Android operating system, which can be more susceptible to pre-installation of malicious software if supply chain security is not rigorously enforced by the manufacturers.
Mitigation for this class of issue typically involves purchasing devices from reputable vendors with strong supply chain security practices. For devices already in possession, users are generally advised to avoid installing applications from unknown sources, regularly update their device firmware, and employ network monitoring tools to detect unusual traffic patterns. In cases where pre-installed malware is suspected, a factory reset may be necessary, though persistent malware embedded in firmware might require more advanced remediation or device replacement.
This incident highlights the growing risks associated with low-cost consumer electronics, particularly those originating from less transparent supply chains. The convergence of ad fraud and proxy network abuse demonstrates a sophisticated approach to monetizing compromised devices. It underscores the importance of consumer awareness regarding the potential hidden costs and security implications of seemingly inexpensive technology, and the broader challenges in securing the IoT ecosystem against supply chain attacks.
