Is Your Smart TV a Proxy Node? How to Block the Popa Botnet

The Living Room Backdoor: How the Popa Botnet Hijacked Your TV

Your smart TV is not just a screen. It is an unmonitored Linux computer sitting on your local network, and right now, it might be renting out your residential IP address to cybercriminals. The FBI, alongside Google, Lumen, and Shadowserver, recently seized hundreds of domains tied to NetNut, a commercial proxy service. NetNut was not just a legitimate business. It was powered by the Popa botnet, a massive network of over two million hijacked devices.

The mechanics are simple and dirty. You download a free app, maybe a clock, a screensaver, or a basic game, to keep the kids entertained. Hidden inside that app is a software development kit, or SDK, that quietly turns your television into an always-on residential proxy node. While you watch a movie, a threat actor in Eastern Europe is routing password-spraying attacks through your home internet connection.

This is a massive opsec failure for the average household. Traditional security tools do not scan your TV firmware for malicious SDKs. When the FBI executed its court-authorized domain seizure, they exposed how deeply these proxy networks have penetrated consumer hardware. For years, these systems have bypassed traditional IP reputation databases because the traffic originates from clean, residential ISP allocations. You can read the details of the coordinated action in the KrebsOnSecurity investigation.

If you think your home network is safe just because you have a strong Wi-Fi password, you are dead wrong. The call is coming from inside the house.

The Numbers Behind the Infection: webOS and Tizen OS Exposed

The scale of this ecosystem-wide infection is staggering. Security firm Spur scanned thousands of smart TV apps and found that a massive portion of them are actively running residential proxy SDKs. On LG's webOS platform, over 42% of available apps contained this background routing code. Samsung's Tizen OS was not much better, with more than a quarter of its applications flagged as proxy nodes.

Smart TVs are the perfect hosts for this kind of silent exploitation. They do not run on batteries, so there is no sudden power drain to alert the user. They do not have cellular data caps, so you will not see a massive bill spike. They simply sit there, plugged into your wall and your router, quietly serving as an exit node for malicious traffic while you sleep.

Following the exposure of this research, LG announced plans to purge these apps from its webOS store. John Taylor, an LG Senior Vice President, confirmed they are actively working to suspend developers who refuse to strip the proxy SDKs from their software. You can track the progress of LG's plans to purge these apps as the industry struggles to clean up its app stores.

But waiting for a corporate patch is a fool's game. The apps already installed on your TV will not magically clean themselves overnight.

Step-by-Step Audit: How to Detect if You Are an Exit Node

You need to audit your network immediately. The first step is checking your external IP address against known proxy exit node databases. Spur provides a quick lookup tool that analyzes your current connection for active proxy footprints. If the tool flags your IP, something on your local network is actively routing third-party traffic.

Next, you must look at your router's client list. Identify the MAC address of every smart TV, streaming stick, and cheap Android box in your house. Monitor their outbound traffic. A television has no business making thousands of persistent outbound connections to random external IPs, especially when the screen is turned off.

Pay special attention to cheap, unbranded Android TV boxes purchased from online marketplaces. Many of these devices ship from the factory with malware pre-installed in the firmware. They are designed from day one to join botnets like Popa, bypassing your local security controls before you even sign into your streaming accounts.

Hardening Your Network: DNS Sinkholes and Router-Level Blocking

To stop these SDKs from communicating with their command and control servers, you must implement DNS-level blocking. A local DNS sinkhole like Pi-hole or AdGuard Home is your best line of defense. By intercepting DNS queries from your TV and sinkholing known NetNut and Popa C2 domains, you kill the proxy's ability to receive routing instructions.

If you have not segregated your IoT devices on a separate VLAN, do it now. Your smart TV should never reside on the same network subnet as your personal computer, network-attached storage, or password manager. If a buffer overflow vulnerability is discovered in your TV's webOS firmware, a segregated VLAN prevents the attacker from pivoting to your critical devices.

Finally, establish strict outbound firewall rules on your router. Block your smart TV from using public DNS servers like 8.8.8.8 or 1.1.1.1, forcing it to use your local sinkhole. Many malicious SDKs hardcode public DNS servers to bypass local Pi-holes, so a firewall rule redirecting port 53 traffic is non-negotiable.

# Block NetNut and Popa C2 domains in dnsmasq / Pi-hole configuration
address=/api.netnut.io/0.0.0.0
address=/c2.popabotnet.net/0.0.0.0
address=/exit.netnut.direct/0.0.0.0