Beware of dodgy Android TV boxes are laced with malware

Broadband and TV deals
(Image credit: Melissa Ross)

New research from Doctor Web has claimed some cheap Android TV boxes are serving secondary functions as hosts for the Mirai trojan, and some customers might not even be up to anything dodgy to have deserved the attack.

This follows news just a few months ago that another wave of malware was affecting budget Android boxes (via Tom’s Guide). This time, the same AllWinner and RockChip-based devices are being affected - both models belong to Chinese companies.

Affected models - Dr Web mentions Tanix TX6 TV Box, MX10 Pro 6K, H96 MAX X3 - now look to be giving up some of their processing power to carry out DDoS attacks or launching clickbots by advertisers to facilitate ad fraud.

Android TV boxes are popular because they are very cheap - often costing less than $20 - and offer a similar feature set to Windows PC.

You don’t know what your cheap Android TV box could be up to

According to Doctor Web, malware can arrive on an unsuspecting victim’s device in one of two ways. It can either be pushed via a firmware update directly from a manufacturer or can be downloaded unknowingly by a user.

In the case of the latter, a user may visit websites and streaming services that promise to deliver content for free, which often promises to be ‘unlocked’ by downloading certain files. It is, of course, these files that end up transporting malware to a host device.

While challenging the monopoly of the dominating companies is an important part of consumerism, hence the broad array of devices available that use the Android Open Source Project (AOSP) platform to access digital content, it’s generally a good idea to be weary of any alternatives from unknown manufacturers. Frankly, abusing consumers’ trust by pushing malware via firmware updates is immoral at the very least.

However, there are some more proactive steps that TV streaming fans can take to protect themselves online. This includes ensuring that the source of a download is reputable and being weary of promises that sound ‘too true.’

More from TechRadar Pro

TOPICS
Craig Hale

With several years’ experience freelancing in tech and automotive circles, Craig’s specific interests lie in technology that is designed to better our lives, including AI and ML, productivity aids, and smart fitness. He is also passionate about cars and the decarbonisation of personal transportation. As an avid bargain-hunter, you can be sure that any deal Craig finds is top value!

Read more
A display showing off the Google TV homepage, with icons for 1917, Scoob!, YouTube and Twitch (among others)
This dangerous malware botnet now covers 1.6 million Android TVs - find out if you're at risk
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
BadBox malware hit after infecting over 500,000 Android devices
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
Dangerous new botnet targets webcams, routers across the world
malware
Google warns of legit VPN apps being used to infect devices with malware
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
Industrial routers are being hit by zero-days from new Mirai botnets
botnet
YouTubers targeted by blackmail campaign to promote malware on their channels
Latest in Security
ransomware avast
Ransomware attacks are costing Government offices a month of downtime on average
Lock on Laptop Screen
Data breach at Pennsylvania education union potentially exposes 500,000 victims
Data leak
Top collectibles site leaks personal data of nearly a million users
Spyware
Stalkerware data breach potentially hits over 2 million users, including thousands of Apple devices
An American flag flying outside the US Capitol building against a blue sky
Five Eyes "cannot replace US intel in Ukraine", claims former US Cyber Command Chief
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Criminals are using a virtual hard disk image file to host and distribute dangerous malware
Latest in News
Apple iPhone 16 Pro Max REVIEW
The latest batch of leaked iPhone 17 dummy units appear to show where glass meets metal on the new designs
Hornet swings their weapon in mid air
Hollow Knight: Silksong could potentially launch this year and I reckon it could be a great game for an Xbox handheld
ransomware avast
Ransomware attacks are costing Government offices a month of downtime on average
Cassian looking at someone off-camera from a TIE fighter cockpit in Andor season 2
Star Wars: Andor creator is taking a stance against AI by canceling plans to release its scripts, and I completely get why
Nintendo x Seattle Mariners partnership
The Nintendo Switch 2 logo will be featured on the Seattle Mariners' baseball jerseys this season
Apple iPhone 16 Pro Max Review
Siri's chances to beat ChatGPT just got a whole lot better