Cheap TV Streaming Sticks Ship Pre-Infected with Malware

You've probably seen them while browsing Amazon or Newegg: generic TV streaming sticks that promise unlimited content for a one-time fee of $20 or $30. They look like a bargain next to a Roku or Apple TV, but a new investigation from KrebsOnSecurity reveals they come with a hidden cost: your network security and privacy.

What's the story?

Brian Krebs examined dozens of cheap streaming sticks from brands like T95, X96, and others sold on major e-commerce platforms. These devices run outdated versions of Android TV (often 9 or 10) that will never receive security patches. Worse, many are pre-infected with malware that turns the stick into a residential proxy node, enabling ad fraud, credential stuffing, and other attacks.

Krebs found that some devices phone home to Chinese servers immediately after connecting to Wi-Fi, downloading payloads that register the device with ad fraud networks. The stick effectively rents out your home IP address to criminals, who use it to spoof legitimate traffic. Even if malware isn't pre-installed, the old Android version is susceptible to known exploits like "Dirty COW" or BlueBorne.

Why it's blowing up on HN

The Hacker News thread reflects a mix of anger and frustration—anger at retailers who continue to sell these devices, and frustration with buyers who fall for the "too good to be true" pricing. One commenter wrote:

"Despite repeated warnings from the FBI and security industry leaders about the security and privacy risks of using these streaming devices, major e-commerce providers like Amazon, Best Buy, Newegg and others continue to sell hundreds of different models and brands."

Another added: "In this case it's actual malice, that the streaming stick is set up for residential proxy and ad fraud straight from the factory. But incompetence can lead to the same place if it's a poorly engineered, unmaintained device with an old version of Android." There's also a sense that retailers should bear some responsibility—the same commenter asked why they get a pass while tainted food sellers don't.

My take

I've been following IoT security for years, and this story is a textbook example of what happens when price is the only buying criterion. These sticks are essentially single-board computers running a decade-old Android kernel with no update mechanism. Even if you wipe the factory image and install something like LineageOS, the hardware is often so slow and limited that it's not worth the effort.

The bigger problem is structural: Amazon, Best Buy, and Newegg profit from volume. They don't test devices for security, and they rarely delist even after findings like this. The FBI has issued warnings about cheap streaming devices, but those haven't changed consumer behavior. As long as people buy them, the incentive to stock them remains.

What makes this different from other IoT threats—like insecure webcams—is that these devices are inside your home network, always on, and connected to your main screen. They can see your Wi-Fi password, scan your LAN, and serve as a launchpad for attacks on other devices. And because they're running full Android, they can execute arbitrary code without user interaction.

What this means for builders

If you build or recommend connected devices, here's the takeaway: security isn't a feature you can add later. It's a property of the entire supply chain. For builders of home automation, media centers, or even simple IoT gadgets, the lesson is to validate every dependency and assume the hardware will be compromised.

Concretely:

• Check for system updates on any device before connecting it to your network. If a streaming stick runs Android 9 with a security patch from 2020, do not connect it.
• Use a separate VLAN for IoT devices. Most consumer routers let you create a guest network that isolates devices. Put cheap streaming sticks there, not on your main network.
• Monitor outbound traffic. Tools like Pi-hole can reveal if your streaming stick is phoning home to unknown IPs. Some devices attempt to contact servers in China or Russia immediately after boot.
• If you're buying a device for a client or project, specify a known good baseline. Roku, Apple TV, and recent Fire TV sticks are not immune to privacy concerns, but they have update commitments and vulnerability disclosure programs.

Here's a simple script to check the Android security patch level via ADB (if you have developer options enabled):

adb shell getprop ro.build.version.security_patch

If the date is more than a year old, consider that device a security risk.

Should you care?

If you're a tech-savvy user who already owns a mainstream streaming stick and updates it regularly, you can largely ignore this. But if you've ever been tempted by a $25 stick on Amazon, or if you have friends or family who buy based on price alone, you should care a lot. The threat is real, the retailers aren't going to fix it, and the only defense is informed purchasing. Stop treating cheap streaming sticks as harmless gadgets—they're a backdoor into your home network.