Which? investigation finds malware in TV boxes
If you're looking at buying a cheap TV box online, proceed with caution. When we tested various boxes available to buy on Amazon, we found alarming insecurities that could put devices on your home network at risk.
Much like streaming sticks, TV boxes let you access content via apps such as BBC iPlayer and Netflix. However, after being made aware of some suspiciously cheap TV boxes from unknown brands on Amazon, we got the following models in for testing:
- Allwinner T95
- Allwinner T95 Max
- Rockchip X88 Pro 10
- Tanix TX68
Read on to find out what our testing revealed, what Amazon said and how to find a genuine and safe TV box or streaming stick.
Tech tips you can trust – get our free Tech newsletter for advice, news, deals and stuff the manuals don’t tell you.
Compromised security
When testing the TV boxes, we found all were using outdated versions of Android or Chrome. Using the latest versions is important as they help protect against the latest online threats.
Particularly alarming was their use of what’s called Android Debug Bridge, which is a powerful tool that provides no network protection and vulnerable to unauthorised access. Our testing also revealed that data transmitted by the boxes also wasn’t secure as HTTP traffic was unencrypted.
Links to malware sites
We also found that the Rockchip X88 Pro 10 communicated with a confirmed malware website, while the Tanix TX68 persistently attempted to download a file over unencrypted HTTP.
Additionally, we discovered unofficial app stores came preinstalled on the TV boxes, which let you download unauthorised apps that haven’t been vetted for safety. Concerningly, these apps remained even after we performed a hardware reset.
Amazon's response to our investigation
When asked to comment, Amazon told us: ‘We have removed these products pending further investigation. If customers have concerns about an item they’ve purchased, we encourage them to contact our Customer Service team.”
None of the manufacturers responded for comment.
Worried if a seller sold you fake goods or gave you a false description of an item? Check out how to spot fake or counterfeit products.
What to do if you own one of the affected boxes
If you own one of the TV boxes we tested, we recommend disconnecting it from the internet to minimise the risk of unauthorised access through the identified vulnerabilities.
It's also important that you review and update security settings (including passwords) for any accounts that you linked to the TV box.
It's also worth contacting the retailer you purchased the TV box from and asking for a refund.
Where to find a TV box you can trust
We thoroughly test all TV boxes and streaming sticks in our labs. To find out which models we recommend, read our in-depth TV box and streaming stick reviews.
Alternatively, check out the best deals below on some of the most popular models we've tested.
*Testing carried out in Oct 2023 and manufacturers/retailers contacted in December 2023
