Are cheap smart devices and TV boxes safe? The warning signs to check before you buy

A low price on its own does not make a smart device dangerous. A cheap plug or camera from a maker you can identify, which ships security updates and says for how long, can be a sensible buy.

The real risk sits with devices you cannot trace back to anyone: no recognizable brand, no updates, and a setup that asks you to weaken your own protections. Generic Android TV boxes are the clearest example, because the FBI has warned that some of them were infected before they ever reached the buyer.

What did the FBI warn about TV boxes?

On 5 June 2025 the FBI published a public service announcement about BADBOX 2.0, a botnet: a network of devices taken over by criminals and controlled remotely without their owners knowing. The FBI says it consists of millions of infected devices, among them TV streaming devices, digital projectors, aftermarket car infotainment systems and digital picture frames.

Devices were infected in two ways, the FBI says: malicious software was installed before purchase, or the device picked it up while downloading apps it needed, usually during setup. Once connected, an infected device can be used as a “residential proxy”: criminals sell or give away access to the home’s internet connection, so their activity appears to come from an ordinary household. The owner may notice nothing.

Older botnets such as Mirai broke into cameras and routers that still had their factory passwords. With BADBOX 2.0 a strong password does not help, because the problem can sit in the software the device came with.

Is a cheap device riskier than an expensive one?

Not because of the price itself. A very low price can hide the work a maker did not pay for: people who fix security flaws, firmware updates for years, a support page with a contact. A higher price does not guarantee any of that either. What matters is whether someone identifiable is responsible for fixing the product.

The FBI notes that most infected devices were made in China, but none of the indicators it lists is about origin: they describe how a device is sold, set up and behaves.

Which warning signs should you check before buying?

The FBI lists these possible indicators of BADBOX 2.0, and stresses that one indicator alone does not prove anything:

apps downloaded from suspicious marketplaces rather than an official store;
a setup that requires Google Play Protect to be disabled (Play Protect is Google’s built-in check that protects Android devices from harmful apps);
generic TV streaming devices advertised as “unlocked” or able to access free content;
IoT devices advertised from brands you cannot recognize;
Android devices that are not Play Protect certified;
unexplained or suspicious internet traffic.

For any connected device, a few more checks follow from the rules below and from the UK National Cyber Security Centre’s advice on smart devices:

A maker you can find. The listing should name a manufacturer with its own website, a support page and a way to report security problems.
A stated update period. The NCSC suggests treating the support end date as a “use by” date. No date at all is a warning sign in itself.
No shared factory password. If the manual gives a fixed login that is the same on every unit and setup never makes you change it, the product follows a practice UK law has banned. Default credentials are how Mirai spread.
An app that asks only for what it needs. Setting up a device needs access to your home network and often Bluetooth. An app that also wants your contacts, call log or text messages is asking for more than the job requires; Google Play reserves call log and text message access for phone, messaging and assistant apps. On Android you can review and remove an app’s access in the phone’s settings.

How can you check an Android TV box?

Google’s help page on Play Protect certification explains that certified devices have passed Android compatibility testing and that only certified devices may include Google apps such as the Play Store. It warns that uncertified devices “may not be secure” and may miss Android system and app updates. The Play Store settings show the status under About, and Google keeps a list of certified devices to check a model against before buying.

A box that tells you to switch Play Protect off so it can install apps from outside Google Play matches two of the FBI’s indicators at once. Not every legitimate streaming device runs Google’s version of Android, though: some well-known ones use their maker’s own system and app store. For those, the same questions apply: an identifiable maker and published updates.

What do the rules require from sellers?

In the UK, the product security regime under the PSTI Act has applied to consumer connectable products since 29 April 2024. Passwords must be unique to each product or set by the user, the maker must explain how to report security problems, and it must publish the minimum period for security updates with an end date. Importers and distributors must not supply a product without the maker’s statement of compliance.

In the EU, the European Commission says that cybersecurity requirements under the radio equipment rules have applied to certain categories of wireless devices since August 2025. The Cyber Resilience Act goes further: its main obligations apply from 11 December 2027, products will carry the CE marking to show they comply, and the end date of the support period, including month and year, must be stated clearly at the time of purchase.

These rules bind whoever places the product on the market; they do not vouch for every marketplace listing, and the CE marking is the maker’s own declaration, not a certificate from an authority.

What should you do with a device you already own?

If a device at home matches several of the signs above, the FBI suggests considering disconnecting it from your network. Then:

Do not count on a factory reset alone. The NCSC advises a reset when someone has taken control of a device. But a reset returns a device to its original settings, so software installed before sale, as the FBI describes, may survive it.
Keep everything else updated. The FBI recommends keeping operating systems, software and firmware up to date, and the NCSC advises switching on automatic updates where a device offers them.
Separate what you keep. A guest Wi-Fi network for smart devices, a basic form of network segmentation, can keep a misbehaving gadget away from your laptop and phone, if your router keeps its guest network apart from the main one (the router’s settings say whether it does).
Report it. In the US, the FBI asks victims of an intrusion to report it to its Internet Crime Complaint Center at ic3.gov.

The smart home guide has a fuller buying checklist, including local control and physical shutters on cameras.

Where to go next

IoT security fundamentals explains how connected devices get attacked.
IoT security regulation covers the Cyber Resilience Act, the UK PSTI regime and the US Cyber Trust Mark.
The smart home, explained shows how ecosystems, hubs and privacy settings fit together.

Topics: consumer security, TV boxes, Android, botnets, smart home, everyday questions