Major Security Flaw in TV Streaming Sticks
Groundbreaking research reveals how popular streaming devices are being used in large-scale ad fraud schemes.
1The Scale of the Threat
Security experts have long warned about TV streaming sticks that promise unlimited content for a one-time fee, secretly renting out users' internet connections. New research reveals these devices also spoof mobile phone identities to click on ads on AI-generated websites. H96 devices disguise themselves as Samsung and Xiaomi phones to participate in an elaborate ad fraud operation.
2Research Details
Pedro Falé from Bitsight uncovered the fraud network by registering an expired domain used by H96 devices. The domain collected hardware information and app lists from thousands of H96 sticks worldwide. Analysis showed nearly all devices were spoofing various phone models. The domain was linked to China-based Zhejiang Fengwo IoT Technology Ltd, operating under Fengwo Group.
3Fraud Mechanism
Two apps installed on the devices were developed by Fengwo Group, which holds multiple patents matching the apps' functionality. The apps turn H96 devices into tools for ad fraud, clicking on ads at AI-generated websites. These sites feature machine-generated news articles and graphics across various categories, only showing ads to spoofed devices.
4AI Digital Humans
Fengwo Group's website claims to be 'redefining human-AI interaction' with over 120,000 'AI digital humans' available for rent. These digital entities serve purposes from emotional companionship to customer service. SSL certificate data links Fengwo directly to the apps found on H96 devices, particularly the phone spoofing mechanism.
5Block-Based Fraud
Fengwo Group uses Google's Blockly visual programming language to build sham websites. Operators can drag code blocks together to create fraud routines without understanding underlying code. This system allows low-skilled workers to participate in fraud operations, significantly reducing the company's operating costs according to internal developer comments.
6Human-Like Clicking
To ensure reliable ad clicking, Fengwo combines three vision and reasoning systems into one interface. This enables bots to identify ads and navigate websites like humans, making the fraud harder to detect. The sophisticated mimicry of human behavior increases the effectiveness of the ad fraud operation while avoiding detection.
7Proxy When TV On, Fraud When Off
H96 devices operate in two modes: when detecting an HDMI signal (TV on), they function as residential proxies; when the TV is off, they switch to waiting for ad fraud tasks. This automatic switching helps conceal fraudulent activities from users. The dual functionality makes the devices valuable tools for both proxy services and ad fraud networks.
8What Users Should Do
Experts recommend avoiding TV streaming sticks that offer unlimited content for one-time payments, particularly H96 devices. Users should stick to licensed streaming services and avoid installing suspicious apps. These fraud networks threaten both user privacy and the integrity of the internet ecosystem. Awareness and cautious purchasing decisions are crucial for protection.
Original article: Krebs on Security — TV Akış Çubuklarındaki Büyük Güvenlik Açığı