Read this before you buy that TV streaming stick(krebsonsecurity.com)
729 points by speckx 19 hours ago | 439 comments
tl;dr: Bitsight researchers found that cheap generic Android TV streaming boxes (like the popular H96) not only rent out users' internet connections as residential proxies, but also spoof themselves as Samsung, Xiaomi, and other mobile phones to click ads on AI-generated websites run by China's Fengwo Group, netting an estimated $50,000/day from ~38,000 devices. The boxes switch modes based on HDMI signal: proxy when the TV is on, ad fraud when it's off. Experts recommend sticking to Play Protect-certified devices from reputable brands.
HN Discussion:
  • Retailers like Amazon should share responsibility for selling these harmful products
  • Similar malicious behavior exists in other cheap Chinese electronics beyond just streaming sticks
  • Personal experience confirms these devices are deliberately malicious and disruptive
  • Buyers should recognize these too-good-to-be-true offers as warning signs
  • ~Ad fraud isn't really harmful, though the proxy abuse is genuinely bad