The editorial argues the real story for developers isn't that cheap hardware is sketchy — it's that a million always-on, ISP-attributed residential IPs acting as proxy exit nodes invalidate the core assumption behind most fraud and bot-mitigation stacks. Because the malware ships on the ROM before purchase, no amount of user hygiene prevents the household from becoming a botnet participant.
Krebs emphasizes that Google has confirmed these devices are not Play Protect certified and never passed Android's compatibility program, making the Android trademark on the box a lie. He highlights that Amazon and Walmart Marketplace pull flagged SKUs only for them to reappear within weeks under new brand names, pointing to a marketplace enforcement failure rather than an isolated vendor problem.
By submitting the Krebs piece to HN where it drew 677 points, speckx surfaced the argument that the T95/X88/MXQ Pro ecosystem represents a systemic marketplace-enforcement failure. The framing centers on how the same Shenzhen ODMs keep shipping the same infected base image regardless of how many SKUs get delisted.
Krebs relays two years of quiet cataloguing by HUMAN's Satori team, Trend Micro, and Google showing BadBox 2.0 as the successor to a 2023 family, now spread to 1M+ devices across 222 countries concentrated in North America and Europe. The position is that this is not a new discovery but a well-mapped, persistent supply-chain botnet that has continued to scale despite disclosures.
Brian Krebs' latest piece walks through what security researchers at HUMAN, Trend Micro, and Google have been quietly cataloguing for two years: an entire tier of cheap Android-based streaming hardware — the T95, X88, MXQ Pro, and dozens of near-clones sold on Amazon, AliExpress, and Walmart Marketplace for $20 to $50 — arrives with botnet malware baked into the system image. The current strain, tracked as BadBox 2.0, is the successor to a family HUMAN's Satori team first exposed in 2023. It has since spread to an estimated 1 million+ active devices across 222 countries, with the bulk of the fleet sitting in North American and European homes.
The malware isn't sideloaded by a careless user; it's on the ROM before the shrink wrap comes off. That single fact is what makes this story different from the usual "don't install shady APKs" advice. Once the device joins a home Wi-Fi network, it phones a command-and-control server, registers as a residential proxy exit node, and starts renting the household's IP address to whoever pays the operator — ad-fraud rings, credential-stuffing crews, scraping-as-a-service outfits, and, per HUMAN's disclosures, at least one operation running fake account creation against major U.S. platforms.
Google has been explicit that these devices are not Play Protect certified — meaning they were never submitted to, and never passed, Android's compatibility program. The Android trademark on the box is, in most cases, a lie. Amazon has pulled specific SKUs after researcher reports, but the listings return within weeks under new brand names, and the underlying ODMs in Shenzhen keep shipping the same base image.
For developers, the interesting angle isn't "cheap hardware is sketchy" — everyone knew that. It's what a million always-on, geographically-distributed, ISP-attributed IPs do to the assumptions baked into modern abuse detection.
Most fraud and bot-mitigation stacks — Cloudflare Bot Management, Akamai Bot Manager, DataDome, hCaptcha's Enterprise tier, the risk models inside Stripe Radar and Auth0 — lean heavily on IP reputation, and 'residential' has historically been the strongest positive signal a request can carry. That's why services like Bright Data and Oxylabs charge $10–$15 per GB for residential proxy traffic while datacenter IPs go for pennies. BadBox 2.0 collapses that price differential from the supply side: the hardware pays for itself in a few weeks of proxy rental, which is precisely why the ODMs tolerate — or actively participate in — the pre-installation.
The second-order effect is that the residential-IP signal is decaying faster than the ML models retraining on it. If a request originates from a Comcast subscriber IP in Ohio at 2pm local time with a plausible User-Agent and TLS fingerprint, most systems still lean approve. When the device generating that request is a $28 stick sitting behind a couch, cycling through a rotating list of victim identities every few minutes, the classifier is reading a lie as ground truth. HUMAN's own writeups note BadBox nodes have been observed doing account takeover attempts, click fraud, and — in the more creative cases — proxying phishing kits so the landing-page IP resolves cleanly.
The patching story is worse than the exposure story. Factory reset doesn't remove the malware because it lives in the system partition, not user-writable storage; the average buyer has no way to reflash a stock ROM, and no stock ROM exists because there was never an upstream vendor. These devices aren't going to get security updates, ever. The remediation is physical: unplug and throw away. HUMAN's disruption in early 2025 sinkholed a chunk of the C2 infrastructure, but the operators rotated within weeks, and the installed base didn't shrink — it just went quiet until the new C2 came online.
There's also a regulatory shoe waiting to drop. The FCC's Cyber Trust Mark program went live in 2025 for consumer IoT, but it's opt-in and covers exactly the vendors who were already doing the right thing. The EU's Cyber Resilience Act, which technically applies to any connected product sold into the bloc, has enforcement teeth arriving in December 2027 — long enough that another two generations of BadBox variants will ship before anyone at customs asks a question.
If you run anything that scores IP trust, stop treating "residential ASN" as a monotonic positive. Cross-reference against device-fingerprint entropy, TLS JA4/JA4S, and behavioral timing — a residential IP whose device fingerprint matches 400 other 'users' this week is not a residential user, it's a proxy. IPQualityScore, Spur, and GreyNoise all publish feeds that flag known BadBox exit ranges; if you're paying for IP intelligence, ask your vendor specifically what their BadBox 2.0 coverage looks like and how quickly they roll new C2-adjacent ranges into the deny lists.
If you're building authentication or account creation flows, the practical hardening is to demote IP-based risk signals one tier and lean harder on device attestation where you can get it — Play Integrity API on Android, DeviceCheck / App Attest on iOS, Passkeys with platform authenticators for the auth path itself. None of these are silver bullets, but they move the trust anchor off the network layer, which is exactly the layer BadBox has poisoned.
For internal-tools and admin-panel auth, this is a good excuse to finally kill IP allowlists as a primary control. A residential IP allowlist for a remote employee is worth almost nothing if the employee's smart TV — or their kid's gaming console dongle — is exit-noding for a Vietnamese click-fraud ring. Zero-trust posture, mTLS, and short-lived tokens are the answer here, and they have been for five years; BadBox is just the latest reason the answer hasn't changed.
The BadBox family isn't going away because the underlying economics are too good — a $28 device that generates $5–$10 a month in proxy revenue for 18 months is a better ROI than most SaaS. The interesting question is when a major cloud or auth vendor finally publishes a public deny-list of ODM firmware hashes and forces the ecosystem to reckon with pre-installed malware as a first-class threat model. Until then, the honest advice to friends and family remains what Krebs closes on: if the streaming stick costs less than the HDMI cable, assume it's the product.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.