Is Your TV Box Safe? Research Uncovers Concerning Security Risks in Popular Streaming Apps

For many households, buying an illegal streaming device may seem like an easy way to save money while enjoying access to movies, television shows and live channels without paying for multiple subscriptions.

But what if that little TV box sitting beside your television could potentially expose more than just your viewing habits?

A new cybersecurity whitepaper titled Understanding the Consumer Cyber Risks of Illicit Streaming Devices in Malaysia, by Professor Paul Watters of Cyberstronomy, has raised concerns about the potential security and privacy threats associated with illicit streaming devices (ISDs).

The research suggests that the risks may go far beyond accessing unauthorised content, with certain streaming applications potentially exposing users' personal information, banking credentials and even other devices connected to their home Wi-Fi networks.

• Popular streaming apps flagged for security concerns

As part of the study, Professor Watters examined 17 popular ISD applications used in Malaysia, including Smarters Pro, Yogurt TV, TeleTV and SyberTV, alongside seven physical streaming devices.

The applications were assessed using several cybersecurity tools, including VirusTotal, which checks files against 96 different antivirus engines, as well as behavioural analysis and network security testing.

According to the findings, every application tested displayed at least one security concern.

On average, each application was flagged by one to two antivirus engines and triggered almost two security alerts, while also demonstrating between four and five techniques associated with malicious cyber activities.

One application, SyberTV, was flagged by nine antivirus engines, while another known as WDHD was reportedly blocked by Google Drive before the researcher could download it.

The findings highlight why consumers should be cautious about applications downloaded from unofficial sources, even when they appear to offer convenient entertainment options.

• Your personal information could be at risk

One of the more concerning findings involves the types of information certain applications could potentially access.

According to the whitepaper, some of the tested applications demonstrated behaviours associated with collecting sensitive information, including:

- Banking and email login credentials.
- Credit card information.
- Contact lists and private text messages.
- SMS verification codes sent by banks.
- GPS location information.
- Photos and other personal files.
- WhatsApp conversations and other private device information.

In some cases, the applications also demonstrated the ability to identify other devices connected to the same Wi-Fi network.

This means the potential risk may not be limited to the person using the streaming device.

• Not all streaming applications pose the same risks

The study categorised the security concerns into three main types. The first involves network-related threats, where certain applications may scan home networks, monitor internet traffic and communicate with remote command-and-control servers.

Applications such as OTT Navigator and TeleTV were highlighted in this category. The second involves applications displaying behaviours associated with spying on users, including accessing microphones, tracking locations, collecting passwords and reading private messages.

Yogurt TV and Yogurt TV Malaysia were among the applications identified in this category. The third involves applications that may secretly download or install additional malicious tools onto devices without users fully realising what is happening.

According to the research, the greatest concern arises when an application combines several of these behaviours.

• Why a clean antivirus result does not necessarily mean an app is safe

You might assume that an application is safe if your antivirus software does not detect anything suspicious. However, the whitepaper warns that this is not necessarily the case.

Some applications, including Smarters Pro, Yogurt TV and Cherry, reportedly returned zero detections during certain antivirus scans. However, further behavioural testing identified activities that raised security concerns.

The researcher highlighted techniques such as obfuscation, anti-analysis and virtual machine detection, which can make malicious applications more difficult for conventional security tools to identify.

In other words, a clean antivirus result should not automatically be treated as proof that an application is harmless.

• Could one TV box put your entire household at risk?

This is perhaps one of the most important concerns for families. Many people assume that keeping their streaming device separate from their phones and laptops will protect their personal information.

However, the whitepaper warns that an infected device connected to a shared Wi-Fi network could potentially create security risks for other connected devices. These may include smartphones, laptops, children's tablets and even work computers used at home.

Depending on the vulnerabilities involved, attackers could potentially use one compromised device as a starting point to access other devices within the network. This makes home network security an important consideration, particularly for households with several connected devices.

• Could the malware already be inside the device when you buy it?

The research also raises concerns about possible supply chain compromises.

This refers to situations where malicious software is introduced during the manufacturing or distribution process, meaning a device could potentially be compromised before it reaches the consumer.

The whitepaper discusses concerns involving firmware-level infections, which may not necessarily disappear even after a device undergoes a factory reset.

However, this should not be taken to mean that every streaming box manufactured overseas is infected.

Rather, it highlights the importance of purchasing devices from trusted sources and checking their security credentials.

•  What happens when your personal information is stolen?

To illustrate the potential consequences, the whitepaper presents a hypothetical scenario involving a father named Mohammed from Selangor.

In the example, Mohammed purchases an illicit streaming device to reduce his household entertainment expenses.

Several weeks later, he discovers that his bank account has been emptied.

The scenario describes how the device could have secretly collected his banking credentials and SMS verification codes, potentially allowing criminals to access his account.

His wife's personal information and private messages could also be compromised.

Although this is a hypothetical example rather than a documented incident, it illustrates how a seemingly small cybersecurity vulnerability could potentially lead to serious financial and personal consequences.

• What should you do if you already own an illicit streaming device?

According to the research, consumers who suspect they are using compromised devices should take immediate precautions.

Some recommended steps include:

- Disconnect and unplug the suspected device from the internet.
- Change passwords for banking applications, email accounts and social media platforms that may have been exposed.
- Check bank statements and transaction histories for suspicious activity.
- Contact your bank immediately if you notice unauthorised transactions.
- Secure other devices that have been connected to the same Wi-Fi network.
- Use legitimate streaming services and purchase devices from trusted sources.

Simply unplugging the device may prevent further communication with malicious servers, but it cannot reverse information that may already have been stolen.

Consumers should therefore take additional steps to secure their accounts and personal information.

What is being recommended to the government?

Beyond individual precautions, the whitepaper also proposes several measures to address the potential risks associated with illicit streaming devices in Malaysia.

In the short term, the recommendations include strengthening controls on the import and sale of illicit devices, blocking known malicious command-and-control servers through internet service providers, checking critical infrastructure and increasing public awareness.

For the medium term, it recommends stronger enforcement against sellers, establishing a dedicated helpline for affected consumers and improving coordination between relevant agencies, including the National Security Council (MKN), National Cyber Security Agency (NACSA), Malaysian Communications and Multimedia Commission (MCMC) and CyberSecurity Malaysia.

In the longer term, the research proposes continued monitoring of emerging threats, greater cooperation with other ASEAN countries and improved intelligence-sharing on potential supply chain risks.

What consumers should remember?

The research examined some of the most popular illicit streaming applications identified in the Malaysian market, but it did not cover every application or device available. It also acknowledges that certain threats, particularly those hidden deep within device firmware, may not be detected through conventional network testing.

For consumers, the bigger lesson is that free entertainment may come with risks that are not immediately visible. While not every streaming device or application will necessarily behave maliciously, downloading applications from unofficial sources and granting unnecessary permissions can expose users to avoidable security threats.

A microphone, contact list or location permission, for example, should raise questions when requested by an application whose main purpose is simply to stream television content. Ultimately, protecting your household's digital security begins with understanding what you are bringing into your home.

Because sometimes, the biggest risk is not what you watch on your television, but what your television device could be accessing without your knowledge.

Source: TrendAI , malaysianwireless , cloud.google 

Image Credit : ipwithease