Received an email from my service provider in Canada warning of Badbox2 infection on my system and possible shutdown if I don’t fix it. Email talks about infection on android boxes and tv’s using sideloading, ie not Google Playstore approved. Anyone else had something similar or heard about this? Instructions to rectify simply say make sure your firmware is up to date. (I have two setups - an Onn 4K Pro and a smart Sony Bravia tv.) Thanks for any guidance.
Never heard of it but here’s some info via Google AI
BadBox 2.0 is a large-scale, global cybercrime operation and botnet that infects cheap, uncertified Android Open Source Project (AOSP) internet-connected devices—such as budget TV streaming boxes, smart TVs, digital projectors, and cheap tablets. The malware is frequently pre-installed at the factory level before the consumer even buys the device. [1, 2, 3, 4]
How BadBox 2.0 Works
- Supply-Chain Infection: Malicious code is baked directly into the device system files (such as
libanl.so) during manufacturing. - Post-Purchase Spread: It can also infect devices later if users sideload or download backdoored apps from unofficial marketplaces.
- Deep System Access: The malware connects to remote command-and-control servers, bypassing standard security measures and persisting even after factory resets. [1, 2, 3]
Main Threats and Uses
- Residential Proxy Networks: It turns victims’ home internet networks into proxy nodes, allowing hidden cybercriminals to route illegal traffic and mask their activities through your IP address. [1, 2]
- Ad and Click Fraud: It launches background browser sessions to load and click digital advertisements, stealing processing power, data, and electricity. [1]
- Secondary Cybercrimes: Threat actors use the botnet to facilitate data theft, credential stuffing, and distributed denial-of-service (DDoS) attacks. [1, 2]
Warning Signs and Prevention
- Risk Factors: Off-brand, uncertified Android streaming boxes or gadgets that promise “unlocked” or free premium content.
- Red Flags: Devices that run unusually slow, overheat, show unexplained high network traffic while idle, or require Google Play Protect to be turned off.
- Safety Tips: Avoid buying unverified, ultra-cheap smart devices, stick to official app stores, and monitor home network activity. [1, 2, 3, 4]
Thanks. I found same info but find it hard to believe that Onn and Sony would be sold infected. I don’t have any “dubious” apps loaded either. Oh well, sit tight and see if anything further happens I guess.
Agreed I have 2 ONN boxes as well. These boxes are certified and even though they are from China I highly doubt it was installed at the factory. Must have been from some app you installed. I’ve never used any apps to scan my boxes for Malware viruses, etc but I think they exist. Perhaps try going that route. If you can identify where it’s at you can delete that app?
Install Virus total and scan your box:
The article is old, but Malwarebytes works on some, maybe all streaming boxes, On 4k Pro for sure…
Thank you all for the tips and comments. I’ll do the scan and see what comes up.
I could probably write a small novel about Canadian Isp’s and what they do and don’t do and when they actually contact you. ** Ie When you’re caught downloading a torrent and Sony contacts them and they by law must forward that to you, nothing more. I would seriously just call your ISP and verify this email was actually from them and not spoofed. It might save a lot of grief because typcially what you just told us is unheard of. Please call them. If it’s a scam you’re going to be pulled in deeper I’m afraid. Good luck.
Appreciate the input. My first thought was that it was a scam. When I got the email the first time, I did call them (Telus) but it’s such a large company tech support knew nothing about it and said they get “hundreds” of warning emails. My concern is (a) I got a second email and (b) this virus does exist seemingly. It’s certainly a PITA.
Update: just did a virus scan and only one app came up…ITVX. Been using that for at least two years. Deleted and now reinstalling….hopefully that satisfies the isp!
@SPIPTV you do have the VirusTotal app to run a scan, right? I highly recommend this app. I run it routinely on my devices just to check. It only takes about 15 seconds to scan.
My point is that Telus has approx 20M customers in Canada. There is just no way they care about them other than business retention and getting paid, certainly not advising them of something like this. The second email endorses x 1000 my thoughts. They don’t have time for this and yes, you would be on record. I doubt the ISP has anything to do with this from the get go. Take care of your system and understand, an ISP’s mission is not to help you with something like this. A scam will send yet another email fishing for something that sooner or later they will request. Good luck.
Lots of knock offs on Ali! Don’t buy only from Walmart!
Exactly! New regime now with weekly virus scans planned. Even if this did all start from a scam or not, best to practice safe hygiene!
Thanks all for your input and guidance. Troy-ers are the best out there.