Android TV boxes found with pre-installed malware - what's going on?

According to a report by TechCrunch, several security researchers have discovered pre-installed malware on popular Android TV boxes, raising concerns. An ongoing investigation by Daniel Milisic has revealed that Android TV boxes sold by ALLWinner and RockChip contain malware.

The companies’ TV boxes are very popular on Amazon due to the low price and the many 5-star ratings. Milisic bought an AllWinner T95 from Amazon last year and discovered it was infected with malware. That experience, and the fact that the device is labeled “Amazon Choice,” prompted Milisic to investigate.

Findings of the researchers

Milisic found that the T95 was connected to a larger botnet of thousands of other infected Android TV boxes around the world. The malware installed on the boxes is called Clickbot. It is designed to secretly tap ads in the background to generate revenue. Once the affected Android TV boxes are powered on, the malware contacts the command and control server, receives instructions, and downloads additional payloads onto the device to perform the ad-click fraud.

His findings were corroborated by security researcher Bill Budington, who bought the same Amazon T95 Android TV box and one from RockChip and found that both came with malware pre-installed. In its independent research, Budigton found that the AllWinner T95Max, RockChip X12 Plus, and RockChip X88 Pro 10 all came with malware pre-installed.

Why is malware preinstalled?

Milisic said Amazon should set a higher standard for retailers and manufacturers. “They are not allowed to sell children’s toys that consist of spinning razor blades. Why is it okay for small, unknown vendors to sell computers acting maliciously, without the knowledge and permission of the owners?” Milisic wondered.

The perpetrators, ALLWinner, RockChip and even Amazon, have not acted on the findings. Are we surprised in a world without responsibility? Our suggestion at this point is that if you want to buy an Android TV box, buy one from a well-known brand like Nvidia or Google. It seems like a good idea to stay away from cheaper Android TV boxes. As they say: you get what you pay for.