Cybersecurity Today: Massive Smart TV Botnets and Major US Cyber Policy Overhaul

Summary

Podcast Summary: Cybersecurity Today

Title: Cybersecurity Today: Massive Smart TV Botnets and Major US Cyber Policy Overhaul
Host: Jim Love
Release Date: June 9, 2025
Description: Updates on the latest cybersecurity threats to businesses, data breach disclosures, and strategies to secure your firm in an increasingly risky digital landscape.

---

Introduction

In this episode of Cybersecurity Today, hosts Jim Love and David Shipley delve into significant developments in the cybersecurity realm, including the emergence of the Bad Box 2.0 botnet, a new variant of Mirai malware targeting DVR devices, shifts in botnet infrastructure, concerns surrounding quantum computing's impact on encryption, and a substantial overhaul of US cybersecurity policy under the Trump administration.

---

1. The Bad Box 2.0 Botnet Threat

[00:34 – 02:35]

Jim Love and David Shipley begin by discussing a critical warning from the FBI about a massive malware campaign known as Bad Box 2.0. This botnet has compromised over 1 million consumer devices globally, primarily targeting Android-based smart TVs, streaming boxes, tablets, and projectors.

Notable Quotes:

• Jim Love [00:36]: "They flagged a massive malware campaign called Bad Box 2.0, which has already compromised 1 million consumer devices around the world."
• David Shipley [00:58]: "These things either come preloaded with malware or get infected during setup via malicious apps or fake firmware updates."

Key Points:

• Device Compromise: Predominantly affects inexpensive, no-name devices manufactured in mainland China and distributed worldwide.
• Infection Methods: Devices are either shipped with pre-installed malware or become infected through malicious applications or deceptive firmware updates during setup.
• Botnet Functionality: Once compromised, these devices form part of the Bad Box 2.0 botnet, connecting to criminal command and control systems. They are repurposed as residential proxies, enabling criminals to obscure their activities by routing traffic through unsuspecting users' home IP addresses.
• Malicious Activities Enabled by Botnet:
  • Ad Fraud Scams: Generating fake clicks to inflate advertising revenues.
  • Credential Stuffing Attacks: Attempting to use stolen usernames and passwords across numerous websites via the compromised network.
• Expansion and Reach: Initially surfaced in 2023, with German authorities disrupting part of the network in 2024. However, the botnet quickly rebounded, with an additional 192,000 infected devices identified shortly after. By March 2025, the botnet had grown to over 1 million devices across more than 200 countries, with hotspots in Brazil, the United States, Mexico, and Argentina.

Technical Insights:

• Operating System Vulnerability: The compromised devices run the Android open-source project, not the official Android TV OS or Play Protected certified systems, making them vulnerable when sourced from bargain tech websites like Temu.

---

2. Mirai Variant Targeting DVR Devices

[02:42 – 03:53]

Transitioning from smart TVs, the discussion moves to a new variant of the renowned Mirai malware, which has been specifically engineered to target digital video recorders (DVRs), particularly models tbk_dvr4140 and tbk_dvr4216.

Notable Quotes:

• Jim Love [02:42]: "There’s a new variant of the infamous Mirai malware that's targeting tbk dvr4140 and dvr4216 devices."
• David Shipley [03:02]: "The vulnerability was disclosed in April 2024 by a researcher going by the name Netsecfish."

Key Points:

• Exploitation Method: Utilizes a command injection vulnerability identified as CVE-2024-3721, allowing attackers to gain control of DVR devices via specially crafted POST requests.
• Active Exploitation: According to Kaspersky's Threat Intelligence Team, their Linux honeypots have detected active exploitation, with compromised DVRs downloading malware and joining the botnet for tasks such as DDoS attacks and traffic proxying.
• Geographical Impact: Infections are notably prevalent in China, India, Egypt, Ukraine, Russia, Turkey, and Brazil.
• Regulatory Challenges: Kaspersky products, which are tracking these infections, are banned in several countries, including the United States, potentially obscuring the full extent of the threat.

Additional Information:

• Infection Estimates: Ranging between 50,000 and 114,000 exposed DVRs, depending on the source of telemetry data.

---

3. Shift in Botnet Infrastructure: From Bulletproof Hosts to VPNs and Residential Proxies

[03:53 – 05:11]

The hosts discuss a significant transition in how cybercriminals manage their botnet infrastructures, moving away from traditional bulletproof hosting services to more elusive VPNs and residential proxy networks.

Notable Quotes:

• Jim Love [04:20]: "But with international law enforcement turning up the heat, there is a shift happening."
• David Shipley [05:07]: "It's going to be a major thorn in the side of things."

Key Points:

• Bulletproof Hosts Decline: Previously, cybercriminals relied on hosting providers that disregarded law enforcement inquiries and operated from countries with lax enforcement.
• New Strategies: Cybercriminals are now utilizing VPNs and proxy networks that intermix legitimate and malicious traffic, complicating efforts to distinguish and block harmful activities.
• Residential Proxy Networks: These involve routing malicious traffic through everyday household devices like old Android phones, outdated laptops, and unmaintained smart TVs. This approach provides fresh rotating IP addresses, making detection by security systems and law enforcement exceedingly difficult.
• Implications for Cyber Defense: Traditional security measures, such as conditional access policies that block IP ranges from certain jurisdictions, become ineffective when attackers use IPs that overlap with legitimate user traffic. As Ronnie Tosowski from Intelligence for Good notes, distinguishing between malicious and legitimate traffic "is going to be a major thorn in the side of things."

---

4. Concerns Over Quantum Computing and Encryption Security ("Q Day")

[05:11 – 07:08]

The conversation shifts to the potential impact of quantum computing on current encryption standards, a phenomenon referred to as "Q Day."

Notable Quotes:

• David Shipley [05:44]: "Experts called on CISOs to start pressuring vendors for clear post quantum cryptography or PQC readiness roadmaps."
• Jim Love [06:03]: "But we haven't seen solid evidence that criminals have been sitting on huge amounts of encrypted data ready to crack."

Key Points:

• Quantum Threat: Quantum computers possess the capability to break widely used encryption algorithms, posing a future risk to data security.
• Current Readiness: While powerful quantum computers capable of this feat are not yet a reality, the cybersecurity community is concerned about "harvest now, decrypt later" strategies, where adversaries collect encrypted data today with the intention of decrypting it once quantum capabilities mature.
• Skepticism and Reality Check: Despite the looming threat, there is limited evidence of widespread "harvest now, decrypt later" campaigns in active cybercriminal operations. Many criminals continue to exploit unencrypted data, emphasizing the importance of addressing present vulnerabilities.
• Recommended Actions:
  • Inventory and Assessment: Organizations should catalog where and how encryption is utilized within their systems.
  • Future Planning: Begin strategizing for the transition to quantum-resistant algorithms.
  • Supply Chain Security: Ensure that suppliers and partners are also preparing for a post-quantum security landscape.

Expert Insight: Jim Love emphasizes the importance of not succumbing to fear but rather taking proactive, pragmatic steps to bolster current security measures while preparing for future advancements.

---

5. Major Overhaul of US Cybersecurity Policy

[07:08 – 11:31]

The episode concludes with an in-depth analysis of a significant policy shift in the United States, where President Donald Trump signed an executive order dismantling numerous cybersecurity initiatives established during the Biden administration.

Notable Quotes:

• Jim Love [07:16]: "A new executive order that wiped a whole slate of cybersecurity initiatives put in place by former President Joe Biden."
• David Shipley [10:09]: "No federal enforcement teeth now."

Key Points:

• Policy Reversal: The Trump administration has rolled back Biden-era efforts aimed at enhancing federal cybersecurity, particularly those focusing on secure software development and supply chain accountability.
• Removed Initiatives:
  • Secure Software Attestations: Requirements for federal contractors to provide technical data verifying that their software adheres to secure development practices.
  • Oversight Mechanisms: Eliminated roles such as secure attestations verification by the national cybersecurity director and referrals of bad actors to the Justice Department.
  • AI and Quantum Cryptography Initiatives: Cut funding and mandates for integrating AI into cyber defense and for advancing post-quantum cryptographic standards.
• New Focus: The Trump administration emphasizes minimal federal oversight, reducing regulatory burdens, and leaving the responsibility of enhancing security frameworks to the private sector without government mandates.
• Implications:
  • Industry Response: While the rollback may be well-received by industries burdened by regulatory requirements, it raises concerns about the long-term resilience and security posture of digital infrastructure.
  • Security Concerns: Without robust federal directives, the advancement of secure software practices, AI-driven cyber defense mechanisms, and preparedness for quantum threats may lag, leaving critical systems vulnerable.
  • Global Coordination: The previous administration's efforts to coordinate post-quantum standards with international allies are now diminished, potentially hindering collective cybersecurity advancements.

Conclusion of Policy Discussion: Jim Love summarizes the implications by contrasting Biden's proactive stance on long-term cybersecurity resilience with Trump's pullback, highlighting the uncertainty and potential risks introduced by reduced federal oversight.

---

Final Thoughts and Recommendations

[11:31 – 12:11]

Jim Love and David Shipley conclude the episode by reiterating the importance of vigilance and proactive security measures in the face of evolving threats.

Notable Quotes:

• Jim Love [11:36]: "Whether it's malware hiding in your TV, DVRs, joining botnets, criminals using your toaster as a VPN exit node, or hype around Q Day, we need to keep cool heads and take smart action."
• David Shipley [12:09]: "Stay patched, stay skeptical, and don't plug in anything you've got for $20 off Amazon or Temu without thinking twice."

Key Recommendations:

• Regular Updates: Ensure that all devices, especially IoT devices like smart TVs and DVRs, are regularly updated with the latest firmware and security patches.
• Vendor Communication: Engage with vendors regarding their plans for post-quantum cryptography to stay ahead of future encryption challenges.
• Security Best Practices: Implement strong authentication measures, conduct regular security assessments, and maintain an inventory of all encrypted data and systems.
• Awareness and Education: Stay informed about the latest cybersecurity threats and policy changes to adapt strategies accordingly.

---

Contact and Feedback: Listeners are encouraged to share their opinions and insights by contacting the hosts at [e-mail] or by leaving comments under the podcast's YouTube video.

---

Disclaimer: This summary encapsulates the key discussions and insights from the podcast episode "Cybersecurity Today: Massive Smart TV Botnets and Major US Cyber Policy Overhaul." For a comprehensive understanding, listeners are encouraged to tune into the full episode.

Transcript

[Jim Love]

The FBI says a million smart TV.

[David Shipley]

Devices are part of bad box 2.0 botnet unpatched critical vulnerability in some security camera DVRs, police busts, forcing criminals away.

[Jim Love]

From bulletproof hosts to using residential proxies.

[David Shipley]

And ask your vendors about their post quantum crypto plans, say experts.

[Jim Love]

Finally, White House dismantles Biden era Cybersecurity.

[David Shipley]

Policy in latest executive order this is Cybersecurity Today and I'm your host David Shipley.

[Jim Love]

Let's kick things off with a major.

[David Shipley]

Warning from the FBI.

[Jim Love]

They flagged a massive malware campaign called.

[David Shipley]

Bad Box 2.0, which has already compromised.

[Jim Love]

1 million consumer devices around the world. We're talking about Android based smart TVs.

[David Shipley]

Streaming boxes, tablets, projectors, you name it.

[Jim Love]

Most of them are cheap, no name.

[David Shipley]

Devices built in mainland China and shipped globally bad. But here's the kicker.

[Jim Love]

These things either come preloaded with malware.

[David Shipley]

Or get infected during setup via malicious apps or fake firmware updates. Once they're compromised, these devices become part of The Bad Box 2.0 botnet, which.

[Jim Love]

Connects them to a criminal command and control system. And then the fun really begins. They're turned into residential proxies, which means.

[David Shipley]

Criminals can route their traffic to your.

[Jim Love]

Home IP address to hide their activity. They're often used in ad fraud scams.

[David Shipley]

Generating fake clicks for revenue.

[Jim Love]

And they're enabling credential stuffing attacks, trying stolen usernames and passwords across hundreds of.

[David Shipley]

Sites using your network.

[Jim Love]

This isn't exactly new though.

[David Shipley]

Bad Box first showed up in 2023.

[Jim Love]

And in 2024 German authorities managed to.

[David Shipley]

Disrupt part of the network.

[Jim Love]

But the crooks bounced back pretty fast. Within a week, researchers found 192,000 more infected devices. And now even mainstream brands like Yandex TVs and Hisense smartphones are getting hit.

[David Shipley]

As of March 2025, cybersecurity company Humans.

[Jim Love]

Satori Threat Intelligence Team says the botnet has topped 1 million devices and spread to more than 200 countries.

[David Shipley]

The biggest infection hotspots Brazil, the United States, Mexico and Argentina.

[Jim Love]

Now here's a technical footnote. These devices run the Android open source.

[David Shipley]

Project, not the official Android TV OS or Play Protected certified systems. So if you're bargain hunting on tech websites, say Temu installing sketchily apps, you.

[Jim Love]

May be bringing home more than upstreaming box. Be careful now. While Bad Box 2.0 is making a.

[David Shipley]

Lot of noise, it's not the only.

[Jim Love]

Botnet in the headlines. Over in the digital video recording or DVR world, there's a new variant of the infamous Mirai malware that's targeting tbk, dvr4140 and dvr4216 devices. Bad guys are exploiting a command injection.

[David Shipley]

Vulnerability tracked as CVE2024 3721 that lets.

[Jim Love]

Them take control of these devices with a specially crafted post request.

[David Shipley]

The vulnerability was disclosed in April 2024 by a researcher going by the name Netsecfish and now Cybersecurity firm.

[Jim Love]

Kaspersky says that their Linux honeypots are.

[David Shipley]

Seeing active exploitation once devices are infected.

[Jim Love]

The DVRs download malware, join a bot.

[David Shipley]

Nest, use to DDoS, traffic proxying and more. Estimates vary, but there are somewhere between.

[Jim Love]

50 and 114,000 exposed DVRs out there.

[David Shipley]

Depending on whose telemetry you trust, kaspersky says. The infections are hitting China, India, Egypt.

[Jim Love]

Ukraine, Russia, Turkey and Brazil particularly hard.

[David Shipley]

But a heads up because Kaspersky products.

[Jim Love]

Are banned now in several countries, including.

[David Shipley]

The United States, this may not be the full picture. Now let's talk cybersecurity infrastructure and one.

[Jim Love]

Of the major drivers for why botnets.

[David Shipley]

Are back in the headlines in a big way.

[Jim Love]

For years, criminals have relied on so called bulletproof hosts to run their operations.

[David Shipley]

Basically, sketchy hosting companies that would look the other way, would not respond to law enforcement, or were hosted in countries that didn't care.

[Jim Love]

But with international law enforcement turning up.

[David Shipley]

The heat, there is a shift happening.

[Jim Love]

At the SleuthCon conference in Arlington, Virginia.

[David Shipley]

Last week, Team Cymaru researcher Thiebault Seiret.

[Jim Love]

Outlined how crooks are ditching sketchy web.

[David Shipley]

Hosts and moving to VPNs and proxy networks that are much harder to trace.

[Jim Love]

These services mix legitimate and malicious traffic, making it tough to separate the good from the bad.

[David Shipley]

Now what's especially concerning is the rise of residential proxy networks where traffic flows through people's home devices like old Android phones, dusty laptops, smart TVs that aren't updated. These offer real fresh rotating IPs, which.

[Jim Love]

Makes it a nightmare for detection systems and law enforcement. It's the equivalent of hiding in plain.

[David Shipley]

Sight, and it's going to be a.

[Jim Love]

Major thorn in the side of things.

[David Shipley]

Like conditional access policies that look to restrict bad actors access through IP ranges from foreign jurisdictions. As Ronnie Tosowski from Intelligence for Good.

[Jim Love]

If attackers are coming from the same.

[David Shipley]

IP ranges as your employees, good luck spotting them. Now, after this botnet bonanza, let's pull back and talk about another issue. And it's the looming specter of what's referred to as the quantum computing moment where it breaks conventional encrypt, whereas some folks are calling it Q Day.

[Jim Love]

At Infra Security Europe conference this week.

[David Shipley]

Experts called on CISOs to start pressuring vendors for clear post quantum cryptography or pqc readiness roadmaps. The idea Even though quantum computers powerful.

[Jim Love]

Enough to break most encryption aren't here.

[David Shipley]

Yet, there's a big concern about harvest.

[Jim Love]

Now decrypt later strategies that criminals are using.

[David Shipley]

Now in theory, here's how this attack would work. Adversaries collect encrypted data from an attack.

[Jim Love]

Say it's an extortion ransomware attack, really.

[David Shipley]

Exfil the data but they can't break through it.

[Jim Love]

But they store it and then they wait until quantum systems can crack it.

[David Shipley]

And that could be years away.

[Jim Love]

Nobody knows for sure. Now here's a dose of healthy skepticism.

[David Shipley]

While qday is a real possibility, we.

[Jim Love]

Haven'T seen confirmed widespread harvest now decrypt later campaigns in the wild in any of the big busts by law enforcement.

[David Shipley]

We haven't seen solid evidence that criminals.

[Jim Love]

Have been sitting on huge amounts of encrypted data ready to crack. Reality is they're sitting on a lot of unencrypted data. So it's important not to let fear run the show. Instead, we should use this moment to.

[David Shipley]

Make sure we're doing smart things like.

[Jim Love]

Inventorying where and how we use encryption, what systems are using, and thinking about.

[David Shipley]

Our planning and and supply chain betting.

[Jim Love]

Which are always good ideas.

[David Shipley]

All right, let's end with a major.

[Jim Love]

Policy u turn coming out of Washington late last week. On Friday, President Donald Trump signed a.

[David Shipley]

New executive order that wiped a whole slate of cybersecurity initiatives put in place by former President Joe Biden.

[Jim Love]

According to the Trump administration, those efforts.

[David Shipley]

Were more about problematic and distracting issues than actual cybersecurity. The new executive order makes big claims, saying it's focused on technical and organizational professionalism to improve America's digital defenses. But let's be clear, this is a massive regulatory rollback, one of the most consequential changes. Trump scrapped Biden's efforts to use federal procurement muscle to push better software security.

[Jim Love]

Remember, this initiative came after years of.

[David Shipley]

High profile breaches think solar winds move it log 4J that were linked to.

[Jim Love]

Weak supply chain software controls.

[David Shipley]

Biden's 2021 executive order started this shift, and by 2024, the government was planning to require secure software attestations where vendors had approved with technical data that their.

[Jim Love]

Products followed modern secure development practices.

[David Shipley]

Trump's new order erases those requirements specifically gone are secure software attestations for federal contractors. Cease's role in verifying those attestations, oversight from the national cybersecurity director and provisions.

[Jim Love]

For referring bad actors to the Justice Department. Instead, the Trump team calls Biden's approach an unproven and burdensome software accounting process.

[David Shipley]

That valued checklists over real security.

[Jim Love]

The only thing still standing?

[David Shipley]

A collaborative effort with NIST to improve.

[Jim Love]

The software development framework.

[David Shipley]

But now it's just voluntary. No federal enforcement Teeth now. What about AI? AI security? It's cut too.

[Jim Love]

Trump took the knife to AI and cyber defense initiatives.

[David Shipley]

Biden's orders had pushed for federal research.

[Jim Love]

Into how AI could be used to.

[David Shipley]

Defend critical infrastructure, especially in sectors like Energy. That included research on secure AI coding.

[Jim Love]

Tools, designing trustworthy AI systems and using.

[David Shipley]

Advanced AI for cyber defense within the Pentagon. That's all gone. Trump's new executive order acts as the.

[Jim Love]

Research priorities, the mandates and those plans to use AI in federal cyber operations.

[David Shipley]

And in fact, the message is let's.

[Jim Love]

Let the private sector figure it out. Don't bake it into government strategy.

[David Shipley]

When it comes to quantum cryptography, that got gutted too. Biden's original order tried to jumpstart post quantum cryptography. That's the stuff we were just talking about earlier that we need to do.

[Jim Love]

To stay ahead of when quantum can break today's encryption. Biden's order told agencies to start migrating to quantum safe algorithms, to push vendors.

[David Shipley]

To do the same and also to.

[Jim Love]

Put efforts in place to coordinate with allies and get global adoption of NIST post quantum computing standards.

[David Shipley]

Trump's order leaves just one piece. CISA still has to keep a list.

[Jim Love]

Of product categories that support post quantum crypto. Everything else scrubbed. No more urgency to migrate, no more push to get vendors or allies moving, and no clear guidance from NIST on the minimum security bar federal contractors should be meeting. And the cuts don't stop there. Trump's new directive also eliminates a plan.

[David Shipley]

To test phishing resistant authentication, NIST led guidance on Internet routing security, a requirement for strong email encryption across agencies, and.

[Jim Love]

OMB's role in managing risk tied to IT vendor concentration. So what does this all mean? In short, we've just watched a major shift in US Federal cybersecurity posture. Biden's approach focused on the long term resilience, supply chain accountability and preparing for an AI and quantum future. Trump's order It's a return to minimal federal oversight, heavy on rhetoric about cutting.

[David Shipley]

Red tape, but light on actual replacement strategy. Now you can agree or disagree with the idea that Biden's security initiatives were too heavy handed. But here's the rum without those mechanisms.

[Jim Love]

That'S going to push software vendors, cloud.

[David Shipley]

Providers and AI developers to build more secure systems, we're seeing more attacks, more automation in cybercrime, and greater reliance on critical digital infrastructure than ever before in society.

[Jim Love]

This rollback might win points with industry.

[David Shipley]

On paperwork, but it leaves a lot.

[Jim Love]

Of unanswered questions about long term digital defense. Now.

[David Shipley]

Bottom line, Whether it's malware hiding in your TV, DVRs, joining botnets, criminals using.

[Jim Love]

Your toaster as a VPN exit node.

[David Shipley]

Or hype around Q Day, we need to keep cool heads and take smart action. Meanwhile, in Washington, Cyber policy just got sent back to party like it's 1999. That's all for now. Stay patched, stay skeptical, and don't plug in anything you've got for $20 off Amazon or Temu without thinking twice. We're always interested in your opinion and you can contact us at editorial@technewsday or.

[Jim Love]

Leave a comment under the YouTube video.

[David Shipley]

I've been your host David Shipley, sitting in for Jim Love, who will be back on Wednesday. Thanks for listening.