What happened: a TV box calling a command and control server
During a recent cybersecurity audit for a customer, we uncovered a serious security risk: an Android TV box connected to the corporate network contained malware. The device was continuously attempting to connect to a command and control (C2) server, in order to install a backdoor into the network.
Through that C2 server, cybercriminals could infiltrate the network, steal data, or even deploy ransomware, bypassing traditional security measures entirely. In practice, this works like a phishing attack, except that it is executed remotely, with no human being tricked into clicking anything.
How did network security monitoring detect the threat?
The customer had not yet subscribed to our 24/7 managed cybersecurity monitoring service (SOC). During a routine security assessment, we detected an unusually high number of botnet alerts originating from a single device on their network.
Our SOC analysts quickly traced the alerts to a TV box, a fact confirmed by the client. Further analysis revealed that many of these devices come pre-installed with malware. In this case, it was a variant of CopyCat, malware capable of gaining root privileges and executing commands remotely.
This is what cyber threat detection looks like in practice: not a dramatic alarm, but an odd pattern of traffic from a device nobody had on their inventory.
What did we discover about the infected device?
Our investigation across multiple public sources showed that the infected TV box was trying to reach a known malicious C2 domain: ycxrl[.]com.
Which devices are linked to this malware?
- T95 (AllWinner H616)
- T95Max (AllWinner H618)
- X12-Plus (RockChip 3328)
- X88-Pro-10 (RockChip 3328)
Which indicators of compromise should you look for?
Beyond the C2 communications, we identified two specific indicators of compromise (IOCs) that signal the presence of this malware:
- a directory called /data/system/Corejava
- a file named /data/system/shared_prefs/open_preference.xml
Our system successfully blocked the C2 connections. It is worth stressing what would have happened otherwise: this malware can also exfiltrate data and execute remote commands, which makes it a severe threat rather than a nuisance.
Why should an SME care about a smart TV?
This case highlights the risk that IoT devices pose to corporate networks. A TV box in the meeting room, a digital photo frame at reception or a smart thermostat in the warehouse sits on the same network as your files, your invoices and your accounting system. Nobody patches it, nobody monitors it, and usually nobody owns it.
In this instance, the AXS Guard DNS security feature detected and neutralised the threat early. Without that protection, attackers could have stolen sensitive corporate data, or used the network as a launchpad for further attacks against customers and suppliers.
How to protect your network in four steps
- Use DNS security. Suspicious DNS requests should be monitored and blocked, whatever device makes them. This is what stopped the attack in this case.
- Audit all connected devices. Check regularly which devices have access to your network and confirm that each one is known, needed and trustworthy.
- Invest in 24/7 security monitoring. A managed service can detect and contain threats in real time, including outside office hours, which is exactly when this kind of traffic tends to appear.
- Avoid cheap, unverified devices. Hardware without proper certification or manufacturer support carries a real risk of pre-installed malware, as this case shows.
What to take away
Smart TVs, digital photo frames and other low-cost connected gadgets can all serve as backdoors into a business network. They are bought outside IT, plugged in without a second thought, and never appear in a security review. Network security monitoring is what turns that blind spot into a detectable event, before someone else uses it.
FAQ about network security monitoring and IoT devices
What is network security monitoring?
Network security monitoring is the continuous analysis of the traffic entering and leaving a network in order to detect suspicious behaviour, such as a device contacting a known malicious domain. Unlike antivirus, which protects a single machine, it looks at the network as a whole, which is how threats on unmanaged devices become visible.
Can a smart TV or a TV box really be hacked?
Yes, and in many cases it does not even need to be hacked. Several low-cost Android TV boxes have been shipped with malware already installed, as documented for the T95 and similar models. Once connected, the device behaves like any other host on your network.
How do I know which devices are connected to my network?
Start with an inventory: list every device with network access, identify an owner for each one, and remove or isolate anything unknown. A cyber risk assessment or a network audit will surface devices that were never declared, which is where most surprises come from.
Is a firewall enough to stop this kind of threat?
A firewall is necessary but not sufficient. This attack came from inside the network, from a device that was allowed to be there. Detection relied on DNS filtering and on someone looking at the alerts, which is the role of a security operations centre.
Not sure what is connected to your network?
Most organisations discover their IoT blind spots during an incident. It does not have to go that way. Talk to an Approach Cyber expert about continuous network security monitoring, and find out what a 24/7 SOC would surface on your own network.
Sources
- T95-H616-Malware research repository (GitHub): https://github.com/DesktopECHO/T95-H616-Malware
- Security Affairs, T95 Android TV box malware: https://securityaffairs.com/140866/security/t95-android-tv-box-malware.htm