BADBOX: Behind the Scenes of an Android Supply-Chain Attack

The talk follows BADBOX, a supply-chain operation in which inexpensive, unbranded Android set-top TV boxes reached buyers with malware already installed. The speaker, a technologist at the Electronic Frontier Foundation, explains how a researcher's report led to a purchase and a basic network check that confirmed the box contacted command-and-control servers. Compromised devices could be turned into residential proxies that routed other people's traffic through a buyer's home connection, and the malware could also intercept one-time passwords used to register accounts.

The middle of the talk turns to a wider investigation by a security firm. The malware sat low in the Android runtime, using a Zygote-based design to embed itself in running applications, and it relied on modular components for ad fraud, SMS abuse and silent app installation. A related component called PeachPit affected roughly 121,000 Android and 159,000 iOS devices and generated billions of ad clicks a day. The speaker also walks through detection approaches, including sampling cheap devices, checking known indicators of compromise, inspecting certificates and user agents, and analyzing backbone traffic to estimate scale.

The talk closes with the regulatory response. EFF filed a complaint with the FTC about resellers that kept selling these devices without warning buyers, and it raised questions about accountability and the digital divide, since cheaper devices often lack built-in protections. For practitioners and consumers, the practical lesson is that compromise can happen before a device ever reaches a home, so research into unfamiliar brands and attention from regulators both matter.