Received an email from my service provider in Canada warning of Badbox2 infection on my system and possible shutdown if I don’t fix it. Email talks about infection on android boxes and tv’s using sideloading, ie not Google Playstore approved. Anyone else had something similar or heard about this? Instructions to rectify simply say make sure your firmware is up to date. (I have two setups - an Onn 4K Pro and a smart Sony Bravia tv.) Thanks for any guidance.
Never heard of it but here’s some info via Google AI
BadBox 2.0 is a large-scale, global cybercrime operation and botnet that infects cheap, uncertified Android Open Source Project (AOSP) internet-connected devices—such as budget TV streaming boxes, smart TVs, digital projectors, and cheap tablets. The malware is frequently pre-installed at the factory level before the consumer even buys the device. [1, 2, 3, 4]
How BadBox 2.0 Works
- Supply-Chain Infection: Malicious code is baked directly into the device system files (such as
libanl.so) during manufacturing. - Post-Purchase Spread: It can also infect devices later if users sideload or download backdoored apps from unofficial marketplaces.
- Deep System Access: The malware connects to remote command-and-control servers, bypassing standard security measures and persisting even after factory resets. [1, 2, 3]
Main Threats and Uses
- Residential Proxy Networks: It turns victims’ home internet networks into proxy nodes, allowing hidden cybercriminals to route illegal traffic and mask their activities through your IP address. [1, 2]
- Ad and Click Fraud: It launches background browser sessions to load and click digital advertisements, stealing processing power, data, and electricity. [1]
- Secondary Cybercrimes: Threat actors use the botnet to facilitate data theft, credential stuffing, and distributed denial-of-service (DDoS) attacks. [1, 2]
Warning Signs and Prevention
- Risk Factors: Off-brand, uncertified Android streaming boxes or gadgets that promise “unlocked” or free premium content.
- Red Flags: Devices that run unusually slow, overheat, show unexplained high network traffic while idle, or require Google Play Protect to be turned off.
- Safety Tips: Avoid buying unverified, ultra-cheap smart devices, stick to official app stores, and monitor home network activity. [1, 2, 3, 4]
Thanks. I found same info but find it hard to believe that Onn and Sony would be sold infected. I don’t have any “dubious” apps loaded either. Oh well, sit tight and see if anything further happens I guess.
Agreed I have 2 ONN boxes as well. These boxes are certified and even though they are from China I highly doubt it was installed at the factory. Must have been from some app you installed. I’ve never used any apps to scan my boxes for Malware viruses, etc but I think they exist. Perhaps try going that route. If you can identify where it’s at you can delete that app?
Install Virus total and scan your box:
The article is old, but Malwarebytes works on some, maybe all streaming boxes, On 4k Pro for sure…
Thank you all for the tips and comments. I’ll do the scan and see what comes up.
I could probably write a small novel about Canadian Isp’s and what they do and don’t do and when they actually contact you. ** Ie When you’re caught downloading a torrent and Sony contacts them and they by law must forward that to you, nothing more. I would seriously just call your ISP and verify this email was actually from them and not spoofed. It might save a lot of grief because typcially what you just told us is unheard of. Please call them. If it’s a scam you’re going to be pulled in deeper I’m afraid. Good luck.
Appreciate the input. My first thought was that it was a scam. When I got the email the first time, I did call them (Telus) but it’s such a large company tech support knew nothing about it and said they get “hundreds” of warning emails. My concern is (a) I got a second email and (b) this virus does exist seemingly. It’s certainly a PITA.
Update: just did a virus scan and only one app came up…ITVX. Been using that for at least two years. Deleted and now reinstalling….hopefully that satisfies the isp!
@SPIPTV you do have the VirusTotal app to run a scan, right? I highly recommend this app. I run it routinely on my devices just to check. It only takes about 15 seconds to scan.
My point is that Telus has approx 20M customers in Canada. There is just no way they care about them other than business retention and getting paid, certainly not advising them of something like this. The second email endorses x 1000 my thoughts. They don’t have time for this and yes, you would be on record. I doubt the ISP has anything to do with this from the get go. Take care of your system and understand, an ISP’s mission is not to help you with something like this. A scam will send yet another email fishing for something that sooner or later they will request. Good luck.
Lots of knock offs on Ali! Don’t buy only from Walmart!
Exactly! New regime now with weekly virus scans planned. Even if this did all start from a scam or not, best to practice safe hygiene!
Thanks all for your input and guidance. Troy-ers are the best out there.
Uh-oh…
Would anyone (with more knowledge than me) buy this to practice configurations and new things on? I’ve messed up my good devices too many times 
. I’m looking for something separate and inexpensive to practice and learn on. I’m a visual person and I want to be able to compare my apps side by side to help me understand what happens when i change a configuration. Then I read about malware and got worried. I am not very computer literate YET and I dont want to get hacked before I am . I ran Virus Total and it was clean.
My question is, considering the risk of malware, is this worth keeping to practice on? Or would you return it, and spend a little more on a recognized brand that might be safer? I still have three weeks to return it.
Thanks
Nah go ahead and beat the crap out of it. The various reports of Malware on these boxes and tablets are mostly clickbait and overhyped in my Opinion. Whatever that is you bought looks like a Monster. 32GB+256GB! Damn! Go Nuts
@Patti , I would not be afraid at all to use that device for the reasons you have listed. I also would not put any personal or banking info on there either, but that’s just me.
I agree. Just do it!
Thank you. The OS Is android but different than my Samsung devices. Sometimes it’s a little frustrating, but I think it will force me to learn more If I have to work through another operating system. I’m still considering an inexpensive Samsung before the Labor Day sales end.