BADBOX 2.0 Infected IoT Device Botnet Scam

Overview

Cheap, off-brand smart TV boxes, projectors, car infotainment units, and digital picture frames sold online come pre-loaded with hidden malware that secretly turns your home network into a criminal proxy used for fraud and other crimes.

How It Works

Criminals compromise low-cost, often Chinese-manufactured Internet of Things (IoT) devices such as TV streaming boxes, digital projectors, aftermarket vehicle infotainment systems, and digital picture frames, either by pre-loading malicious software onto the device before a consumer ever buys it, or by hiding a backdoor inside an app the device downloads during setup. Once the device connects to a victim's home Wi-Fi, it can be pulled into the "BADBOX 2.0" botnet, and criminals then sell or give away access to that compromised home network's internet connection, routing other criminals' malicious traffic through the unsuspecting victim's residential IP address to disguise it as legitimate activity and use it for other criminal purposes.

Red Flags

• The device was purchased from an unofficial or suspicious app marketplace rather than a certified app store
• Setup instructions tell you to disable Google Play Protect or other built-in security settings
• A generic, unbranded TV streaming device is advertised as 'unlocked' or able to access free premium content
• The IoT device is from an unrecognizable or off-brand manufacturer
• The Android device is not Google Play Protect certified
• You notice unexplained or unusual internet traffic coming from a smart device on your home network

Real Examples

• The FBI's PSA warned that cyber criminals gained unauthorized access to home networks through compromised TV streaming devices, digital projectors, aftermarket vehicle infotainment systems, digital picture frames, and other products, most of which were manufactured in China.

Where It Spreads

How to Protect Yourself

• Avoid downloading or sideloading apps from unofficial marketplaces that advertise free streaming content
• Keep device operating systems, firmware, and apps updated, and never disable built-in malware protections like Google Play Protect
• Periodically monitor your home network's internet traffic for suspicious or unexplained activity and assess all IoT devices connected to home networks for suspicious activity, disconnecting any device you suspect is compromised
• Report suspected compromised devices or related criminal activity to the FBI's Internet Crime Complaint Center at ic3.gov

Related Scams