Public Advisory: Security Risks Associated with Untrusted Streaming Devices and Network-Connected Photo Frames

Protecting Your Home Network from Compromised Consumer Devices

Internet-connected consumer electronics can provide convenient entertainment and useful features, but devices from unknown manufacturers or those offering unusually broad functionality at little or no recurring cost can introduce significant security risks.

We are issuing this advisory following the identification of multiple potentially compromised devices on customer home networks recently, including both Android-based “free TV” streaming devices and network-connected digital photo frames. We are seeing an uptick in malicious and illegal activity associated with these devices, and our technicians have assisted affected customers with identifying and removing several of them recently.

“Free TV” Streaming Devices

Devices commonly marketed as SuperBox, as well as similarly marketed Android streaming boxes, are promoted as providing thousands of television channels, movies, sports and premium streaming services for a one-time purchase rather than a conventional monthly subscription.

The security concern is not simply the source of the television programming. Many of these devices rely on modified versions of Android, unofficial application stores, or applications obtained outside the normal Google Play ecosystem. Security researchers and the FBI have documented a broader class of compromised Android devices associated with the BADBOX/BADBOX 2.0 botnets.

The FBI specifically identifies generic Android streaming devices advertised as “unlocked” or capable of providing free content, devices using suspicious application marketplaces, devices that require Google Play Protect to be disabled, and devices from unfamiliar manufacturers as potential indicators of concern.

Recent independent research has also identified SuperBox devices containing software capable of turning a customer’s Internet connection into a residential proxy, allowing third-party traffic to be routed through the customer’s home Internet connection without the customer’s knowledge. That traffic can include activity associated with account takeover, credential theft and attempts to bypass enterprise security controls.

This means a compromised streaming box may not simply be a security problem for the television attached to it. It can become a participant in criminal activity conducted through the customer’s Internet connection.

Network-Connected Digital Photo Frames

Digital photo frames may appear to be harmless household appliances, but Wi-Fi-enabled frames are computers connected directly to the Internet and the customer’s home network.

Security researchers have identified serious vulnerabilities in Uhale-powered digital photo frames, including products sold under numerous different brand names through major online marketplaces, including Amazon. Research published by Quokka documented vulnerabilities that could allow remote code execution, unauthorized file access, malware installation and compromise of the device. Some examined devices were found capable of downloading and executing malicious software during startup.

Importantly, Uhale is not necessarily the name printed on the front of the frame. Researchers found numerous rebranded products using the Uhale software ecosystem. Their assessment identified products sold under brands including FANGOR, Forc, Caxtonz, BIGASUO, Euphro, SAMMIX, WONNIE, Jaokpo, MaxAngel and others.

The risks associated with these vulnerabilities extend beyond the photographs displayed on the device. A compromised frame can potentially provide an attacker with a foothold on the home network, facilitate malware distribution, expose files or communications, participate in a botnet, or be used to attack other devices.

Uhale has subsequently reported that security fixes have been released in newer versions of its software and recommends affected customers update their devices. However, because products using the Uhale software have been sold under numerous brands and through multiple retailers, customers may have difficulty determining whether their particular device is affected.

What We Recommend

Customers should carefully consider any Internet-connected device that:

• Promises thousands of television channels or premium content for a one-time fee.
• Requires applications to be installed from unofficial app stores.
• Requires Google Play Protect or other Android security features to be disabled.
• Comes from an unfamiliar or difficult-to-identify manufacturer.
• Is no longer receiving security or firmware updates.
• Was purchased as an inexpensive Wi-Fi digital photo frame, particularly if it uses the Uhale application or software.
• Exhibits unexplained Internet activity, unusual bandwidth consumption, or other behavior that cannot be explained by normal use.

If you have one of these devices, disconnecting it from your home network is the safest immediate precaution while determining whether it is affected. For devices that support legitimate manufacturer security updates, install those updates where available. For older or unsupported devices, replacement may be preferable to continued exposure.

Stay Informed with LTC Connect Commander

One of the best ways for customers to identify suspicious behavior on their home network is to download and onboard the LTC Connect Commander app and enable push notifications.

The LTC Connect Commander app can provide alerts and visibility into activity on your network, helping you become aware of potentially suspicious devices or behavior sooner. Early notification can make it possible to identify and remove a compromised device before it causes additional problems.

Our support team is available to assist customers who believe they may have an affected streaming device, digital photo frame, or other suspicious Internet-connected device on their network.

If you have any questions about these recommendations or would like to know more about how you can better manage your home network using our LTC Connect Commander app, please go to https://ltcconnect.com/commander/, or give us a call at 270-542-4121 or 270-934-4121.