# Streaming Box Home Network Check Kit Version 1.0, November 14, 2026. From jwatte.com: https://jwatte.com/blog/free-tv-streaming-box-home-network-risks/ What this is: a printable checklist for anyone with an Android streaming box at home, in a rental or in an office, especially a box sold with a promise of free channels, movies or sports. Some of these boxes have been found renting out the owner's internet connection to strangers, leaving the box open to any device on the same Wi-Fi, and carrying software that a factory reset does not remove. Every claim here comes from the sources listed in part 7. Where a step is our own advice rather than a source's, it says so. This kit is informational. It is not legal or security consulting advice. ## Part 1: The 20 minute home check Who does this: whoever looks after the Wi-Fi at home. No tools needed beyond your phone and the TV remote. ### Step 1. The FBI's six warning signs (about 5 minutes) The FBI listed these in its June 5, 2025 warning about the BADBOX 2.0 botnet. Tick each one that fits your box. - [ ] "The presence of suspicious marketplaces where apps are downloaded." - [ ] "Requiring Google Play protect settings to be disabled." - [ ] "Generic TV streaming devices advertised as unlocked or capable of accessing free content." - [ ] "IoT devices advertised from unrecognizable brands." - [ ] "Android devices that are not Play Protect certified." - [ ] "Unexplained or suspicious Internet traffic." The FBI also says: "An indicator alone does not accurately determine malicious cyber activity or a crime." Our reading: one tick means look closer, several ticks mean go to Part 2. Done when: every box in the house has been checked against all six signs. ### Step 2. The certification check (about 5 minutes) Google's help page gives this path in the Google Play Store app: 1. Open the Google Play Store app. 2. At the top right, tap the profile icon. 3. Tap Settings. 4. Tap About to see whether the device is Play Protect certified. Google's page is written for phones and tablets. TV menus differ by model, so on a TV box look for the Play Store's settings and an About entry. If there is no Google Play Store at all, the box has not shown you it passed Google's testing. Remember two things. Google says Play Protect certification means the device passed Google's compatibility testing. And in November 2026 Google said one manufacturer, Videostrong, got past those tests by loading its malicious code after the first boot. So certified is the floor, not a guarantee. Done when: you have written down Certified, Not certified, or No Play Store for each box. ### Step 3. The router device list check (about 10 minutes) CISA (the US Cybersecurity and Infrastructure Security Agency) says to use your router maker's website to watch for unauthorized devices on your network. In practice: 1. Open your router's app, or type its admin address into a browser. The address is usually printed on a sticker on the router. 2. Find the list of connected devices. It may be called Clients, Devices, Attached devices or Network map. 3. Match every entry to something you own: phones, laptops, TVs, speakers, cameras, the streaming box. 4. Write down anything you cannot match. An unknown device often shows up as a string of letters and numbers or a maker name you do not recognize. Done when: every entry on the list has a name you can point to, or is written down as unknown. ### Your result - No signs, certified box from a maker you can name, nothing unknown on the router: keep the box, keep Play Protect on, and repeat this check every few months. - Several signs, not certified, or the box was sold as free TV: go to Part 2. - Unknown devices on the router: change your Wi-Fi password (Part 2, step 5) and recheck the list. ## Part 2: If you find one 1. Unplug it and take it off the Wi-Fi. Who: the owner. The FBI urges people to consider disconnecting suspicious devices. Done when: the box has no power and no network cable. 2. Do not rely on a factory reset or on uninstalling apps. Who: the owner. The FBI says malware can stay through a factory reset; Google says the XCPE backdoor reinstalls itself from the firmware on reboot; Plume says preinstalled apps can survive a factory reset. Done when: you have decided to replace the box, not reset it. 3. Ask the seller for a refund or clean firmware. Who: the owner. Malwarebytes suggests asking the seller about a fix or replacement. Expect little. Done when: the request is sent in writing and you kept a copy. 4. Dispose of it as electronic waste. Who: the owner. Our advice: do not sell it or give it away, because the next owner gets the same problem. Done when: it has gone to an e-waste drop-off. 5. Change the Wi-Fi password if the box knew it. Who: whoever runs the router. Our advice: the box stored that password. Done when: your own devices have rejoined with the new password. 6. Change the passwords of every account that was signed in on the box. Who: each person who used it. Google says XCPE operators took account information off infected boxes. Done when: each of those accounts has a new password, with two step sign in turned on where offered. 7. Check the router. Who: whoever runs it. CISA says to change the router's default administrator password and keep its firmware up to date. Done when: the admin password is not the one on the sticker and the firmware is current. 8. Watch your accounts. Who: everyone in the house. The FBI suggests alerts for suspicious logins and transactions. Done when: alerts are on for banking and email. 9. Report it if you were harmed. Who: the person harmed. The FBI asks victims to file a complaint at https://www.ic3.gov/ Done when: you have a complaint number saved, or there was no loss to report. About guest networks: putting the box on a separate guest network or VLAN can keep it away from your laptop and phone. It does nothing about strangers using your internet address, because the guest network goes out through the same address. A box that rents out your connection has to go. (Our advice. Malwarebytes said in September 2026 that such a box should not be trusted even on a guest network, and in November 2026 that a separate network keeps other devices separate without making the box safe.) ## Part 3: A note for family members (print this page) Why we unplugged the TV box We took the streaming box off the TV because boxes like it have been found doing things we did not sign up for. Researchers and the FBI have found that some boxes sold as free TV quietly let strangers use our home internet. Their traffic goes out with our home address on it, so to a bank or a website it looks like it came from us. Some boxes also leave a door open that lets any other phone or computer on our Wi-Fi take over the box, and some carry software that a reset does not remove. Nobody did anything wrong by buying or using it. Many people were told these boxes were fine. What changes for you: - The box is gone and will not come back. - We changed the Wi-Fi password. Here it is: ______________________ - If you signed into any account on the box (email, streaming, social media, shopping), please change that password and tell me when you have. - If you get a sign in alert you did not expect, tell me. What we watch instead: ______________________ Questions? Ask ______________________ ## Part 4: Device rule for a small office or rental (copy ready) Our network device rule 1. Only devices approved by [owner or IT contact] may connect to the office network. This includes TVs, streaming boxes, smart speakers and cameras. 2. Guests, personal phones and TVs use the guest network: [guest network name]. Computers that handle payments, payroll or customer records stay on the main network. 3. Streaming boxes sold as free TV, or boxes from brands we cannot identify, are not allowed on any of our networks, including the lobby or waiting room TV. If one turns up, nobody is in trouble. The box goes home and we check the network. 4. [Owner or IT contact] checks the router's device list on the first business day of each month and removes anything that cannot be identified. 5. Lost or suspicious devices are reported to [owner or IT contact] the same day. Why: the FBI warns that criminals use home and small business connections to hide their activity, and advises businesses to keep unauthorized devices off the network, split the network into segments, and block known proxy networks. Our office address is the one our bank, payroll service and email provider see. Effective date: ____________ Approved by: ____________ ## Part 5: Questions to ask before buying any streaming device - Who makes it, and can I find the maker's own website and support page? - Is the maker on Google's Android TV partner list (https://www.android.com/tv/partners/), or is it a well known brand with its own app store? - Does the Play Store's About screen say the device is Play Protect certified? - Does the seller tell me to turn off Play Protect or install apps from a different store? (If yes, walk away. The FBI lists both as warning signs.) - Does it promise one payment for every channel and movie free forever? (The FBI advises avoiding devices that claim to offer free sports, TV shows and movies.) - When did it last get a software update, and does the maker say how long it will keep sending them? - Do any apps offer to pay me for sharing my unused internet? (Google warns consumers to be extremely wary of these.) ## Part 6: Free and legal options Names and links only. No affiliation, no ranking. - Pluto TV: https://pluto.tv/ - Tubi: https://tubitv.com/ - Plex free section: https://www.plex.tv/watch-free/ ## Part 7: Sources and read dates All read on November 14, 2026 (UTC). - FBI IC3, Home Internet Connected Devices Facilitate Criminal Activity, I-060525-PSA, June 5, 2025: https://www.ic3.gov/PSA/2025/PSA250605 (six signs, caution, disconnecting) - FBI IC3, Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals, I-031226-PSA, March 12, 2026: https://www.ic3.gov/PSA/2026/PSA260312 (factory reset, passwords, account alerts, reporting, business advice) - Google Threat Intelligence Group, Shutting the Door on the XCPE Botnet, November 2, 2026: https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet (Videostrong, test gap, reinstall on reboot, account information, bandwidth apps, reputable manufacturers) - Google Play Help, Check and fix Play Protect certification status: https://support.google.com/googleplay/answer/7165974 (certification path and meaning) - Google, Android TV Global Partners: https://www.android.com/tv/partners/ - Plume, SuperProxy: When Your TV Box Becomes Someone Else's Gateway, May 28, 2026: https://www.plume.com/newsroom/when-your-tv-box-becomes-someone-elses-gateway - Plume Security Labs, SuperProxy Part 1, May 2026: https://cdn.plume.com/ca/69/b1c4a022451884c2c6124341c8f5/plumereserachpaper-superproxy-may2026.pdf (factory reset) - Malwarebytes, Pieter Arntz, Free streaming boxes may be routing criminal traffic through your home, September 4, 2026: https://www.malwarebytes.com/blog/news/2026/09/free-streaming-boxes-may-be-routing-criminal-traffic-through-your-home - Malwarebytes, Pieter Arntz, A hidden backdoor put 1.3 million set-top boxes to work for criminals, November 3, 2026: https://www.malwarebytes.com/blog/mobile/2026/11/a-hidden-backdoor-put-1-3-million-tv-boxes-to-work-for-criminals - CISA, Home Network Security (February 1, 2021, archived): https://www.cisa.gov/news-events/news/home-network-security (device list, router password, firmware) - Pluto TV, https://pluto.tv/ and Plex, https://www.plex.tv/watch-free/ (read November 14, 2026); Tubi, https://tubitv.com/ (read through our research file, November 14, 2026).