Electronic Frontier Foundation Calls for FTC Action on Poisoned Set-Top Boxes

TV set-top boxes infected with malware are being sold online at Amazon and other resellers, and the Electronic Frontier Foundation wants the Federal Trade Commission to put a stop to it.

“Recent reports have revealed various models of Android TV set-top boxes and mobile devices that are being sold by resellers Amazon, AliExpress, and other smaller vendors to include malware before the point of sale,” the EFF wrote Tuesday in a letter to the FTC.

“These include malware included in devices by Chinese manufacturers AllWinner and RockChip,” the letter continued. “We call on the FTC to use its power…to sanction resellers of devices widely known to include harmful malware.”

The EFF revealed in May that several set-top box models — AllWinner T95, AllWinner T95Max, RockChip X12-Plus, and RockChip X88-Pro-10 — were infected out of the box with malware from the BrianLian family. “These devices were widely reported to contain malware, and Amazon and others still made them available,” said EFF Senior Staff Technologist Bill Budington.

“We wanted to see the resellers take the devices down and make sure their customers are protected,” he told TechNewsWorld. “Unfortunately, that’s not what we saw, and we thought it was time to bring this up to regulatory parties.”

FTC spokesperson Julianna Gruenwald Henderson said the agency had no comment on the letter.

“Security is of the utmost importance to Amazon,” spokesperson Adam Montgomery told TechNewsWorld. “We are working to learn more about these findings and will take appropriate action if needed.”

Malware-Infected Boxes: Gateway to Click-Fraud

In its letter, the EFF explained that the devices, when first powered on and connected to the internet, will immediately begin communicating with botnet command and control servers. From there, the devices connect to a vast click-fraud network. All this happens in the background of the device, without the buyer’s knowledge.

“We believe the resellers of these devices bear some responsibility for the broad scope of this attack and for failing to create a reliable pathway for researchers to notify them of these issues,” the EFF wrote.

It noted that security researcher Daniel Milisic, who deeply researched and published his findings on the malware infecting the devices, mentioned finding it difficult — if not impossible — to reach out to Amazon and report the issue.

It added that EFF also reached out to Amazon, yet the products are still available.

“While it would be impractical for resellers to run comprehensive security audits on every device they make available,” the letter said, “they should pull these devices from the market once they are revealed and confirmed to include harmful malware.”

Legal Exposure for Consumers Unaware of Malware

The EFF warned that consumers with the infected devices could face legal perils.

“These devices put buyers at risk not only by the click-fraud they routinely take part in, but also the fact that they facilitate using the buyers’ internet connections as proxies for the malware manufacturers or those they sell access to,” the letter explained.

“This means that any nefarious deeds done using this proxy will look as though they were originating from the buyers’ internet connection, possibly exposing them to significant legal risk,” it continued. “This can result in real harm to buyers of these devices, presenting an unacceptable risk which must be addressed.”

The EFF called on the FTC to sanction sellers of the devices because they present “a clear instance of deceptive conduct: the devices are advertised without disclosure of the harms they present.”

It also urged the FTC to use its regulatory power to make it easier for customers to report compromised devices either directly to the device vendors or to the commission itself, which can then inform the vendor and ensure it takes remedial action.