Hijacked Android TV boxes can quietly expose your business network. Here's what to check behind your screens and how to keep your devices separate.
Last week Google shut down a network of more than 1.3 million hijacked devices, most of them inexpensive Android TV boxes. Tens of thousands were in Australia. The malware wasn't something owners downloaded by mistake. Google says the manufacturer built it in at the factory and sold access to criminals.
It isn't the first time. Google took down a similar network in January, and it has disrupted others since, including one built on around 2 million devices.
Here's why that matters for a business, and not just someone's lounge room.
What was actually inside the box
The backdoor lived in the device's firmware, the core software that runs before anything else. It had the same level of control as the operating system itself. Some of the boxes were even advertised as Google certified.
So the TV showed the footy or the waiting room playlist as normal, while the box quietly took instructions from someone else.
Why would a manufacturer do that? Because access sells. Proxy services charge their customers to route traffic through real home and business connections, which look far less suspicious than a data centre. Google has banned the company from making certified Android devices, but the boxes already sold are still out there, and they were sold under a range of brand names.
Where these devices tend to turn up in a business:
- The streaming stick behind the reception or waiting room TV. Often bought cheaply online, or brought in by a staff member.
- Digital signage and menu boards. Many run on the same kind of Android hardware.
- Specialist equipment. Researchers also found this malware in telehealth devices.
- Something an installer left behind. A signage or AV supplier's box that nobody in the business set up or tracks.
What it does while the TV looks normal
▶️ Your internet connection is rented to strangers. These networks sell "residential proxy" access, meaning other people's traffic goes out through your connection and looks like it came from your business. When that traffic is fraud or scam logins, it's your address that gets blocked or investigated.
▶️ It sits on the same network as everything else. Operators could install apps, take screenshots, inject keystrokes and open a remote connection. If the TV box shares Wi-Fi with your PCs and practice software, it's a foothold right next to them.
▶️ You can't uninstall your way out. The backdoor reinstalls itself from a protected part of the device every time it restarts. Google's takedown cut off the criminals' control servers, but it doesn't remove the code from boxes already out there.
▶️ It switches off the built-in protection. The malware can disable Google Play Protect, the scanner meant to catch harmful apps on Android, so the device can't flag its own problem.
▶️ Nobody notices. A TV box is rarely on anyone's asset list, so it won't get patched or monitored, and nobody checks it.
What to do this week
None of this needs specialist tools. Most of it is knowing what's plugged in.
✅ Walk the office and list every box behind a screen. TVs, signage players, meeting room displays and anything else running Android. It takes about ten minutes.
✅ Replace no-name boxes rather than trying to clean them. Researchers recommend disconnecting and replacing affected devices, because removing the app doesn't work and it's unclear whether a factory reset does. A mainstream brand from an Australian retailer costs a little more and is a lot easier to trust.
✅ Put TVs, signage and smart devices on a separate network. A guest network or separate VLAN lets them reach the internet without being able to see your computers, server or practice software. This is the single change that limits the damage from any device you can't vouch for.
✅ Ask suppliers before they plug something in. Signage, AV and equipment installers should tell you what they're connecting and which network it's going on.
✅ Get a list of everything on your network. Most business firewalls and Wi-Fi systems can show every connected device. Your IT provider can run that report and flag anything nobody recognises.
Take ten minutes this week to find out what's plugged in behind your screens. If you need a hand, get in touch.
- cyber security
- Android TV boxes
- network security
