Google Targets Proxy Service Exploiting TV Devices for Cybercrime
Google has initiated a crackdown on NetNut, an Israeli residential proxy provider accused of exploiting connected TV devices to facilitate cybercrime. In collaboration with the FBI and Lumen Technologies, Google disrupted a botnet known as "Popa," which has reportedly infected millions of Android-based TV streaming devices. This botnet is linked to NetNut, which sells residential proxies that allow users to route their internet traffic through IP addresses in various countries.
Cybersecurity researchers discovered that the botnet was leveraging these consumer devices to conduct a range of malicious activities, including account hijacking. Google's investigation revealed that NetNut's network encompasses at least 2 million devices globally, with evidence of 316 distinct threat clusters utilizing suspected NetNut proxy exit nodes, including groups involved in cybercrime and espionage.
According to Google's report, these malicious actors can mask their original IP addresses while accessing victim environments and conducting password spray attacks. Additionally, when a consumer device acts as an exit node, unauthorized traffic can flow through it, potentially exposing other devices on the same home network to internet threats. In some instances, hijacked traffic has been used for ad fraud, inflating web traffic to generate revenue.
Google claims that NetNut expanded its botnet by distributing software development kits for commonly used home devices, such as smart TVs and streaming boxes. This preinstalled software allowed NetNut to maintain access to these devices and relay internet traffic without the owners' knowledge.
In response to these findings, Google has shut down the accounts and services that NetNut used to control the botnet. The company has also activated Google Play Protect to disable applications known to incorporate NetNut SDKs, ensuring ongoing protection for users against future installations. Google estimates that this disruption will significantly reduce the number of devices available for NetNut's operations.
Despite these efforts, Google warns that NetNut may attempt to rebuild its network, potentially by acquiring capacity from competitors. The company advises consumers to purchase TV streaming devices from reputable manufacturers rather than unknown providers selling inexpensive set-top boxes that may be preloaded with malware. Google cautions users to be wary of applications that promise payment for "unused bandwidth" or for "sharing your internet," as these are common tactics used by malicious proxy networks to expand their reach and could introduce security vulnerabilities to home networks.
NetNut and its parent company, Alarum Technologies, have not yet responded to requests for comment. Currently, NetNut's website promotes dubious services, including "limitless web data extraction" aimed at companies seeking to scrape data for AI training.
