Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies

Summary: Bitsight researchers detailed an operation they named Fuyao, attributed to Zhejiang Fengwo IoT Technology Co., Ltd., in which cheap Android TV boxes ship with apps that rewrite their hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones and click ads on operator-run sites. The same apps switch to relaying other people's traffic through the owner's broadband line as a SOCKS5 exit node when the box detects an HDMI signal, and in one day the sinkhole received 65,957 reports from about 38,000 unique MAC addresses after filtering for devices carrying the Fuyao apps.
Key Takeaway: Bitsight modeled gross returns at $1.25 per device per day, or about $47,500 daily if 38,000 devices were active, with annual revenue estimated at up to $40 million at the advertised fleet size - estimates, not observed revenue. The sources checked do not establish who installed the apps or at what point in the supply chain they appeared, and the material still lacked a complete list of affected packages, firmware builds, and network indicators.

Read the original at The Hacker News ↗