Smart TV stick warning in South Africa

South Africans who don’t have access to or can’t afford a smart TV can use streaming media boxes or sticks to access platforms like Netflix and Showmax on their TVs, but some of these devices could carry malware.

It is highly recommended that those looking for an Android TV stick or box opt for a Google-certified device. Tech researchers have found that many cheaper, non-Google-certified devices are used as vectors for malware.

Google provides a spreadsheet of certified Android TV boxes on its website.

These certified boxes also offer guaranteed support for all official apps and official versions of the Android TV operating system, giving some assurance of better performance.

According to Jamie Akhtar, CEO and co-founder of UK-based cybersecurity firm CyberSmart, many non-certified streaming devices are often modified using third-party software that lacks the robust security measures of legitimate platforms.

“Users expose themselves to malware, spyware, and backdoors embedded within these unauthorised applications,” Yahoo News quoted Akhtar as saying.

Many of these devices are listed on popular online marketplaces in South Africa. However, they are a global threat, with cybersecurity firm Human Security warning people about a specific group distributing the malware through Android devices, including streaming sticks.

“The Badbox operation, based out of China, sold off-brand mobile and connected TV devices on popular online retailers and resale sites,” it said.

“These Android devices came preloaded with a known malware called Triada.”

Human Security explained that, in the case of Triada, the device “calls home” as soon as it is powered on, after which it receives fraud “modules” remotely.

It identified one of the fraud modules as adware, dubbed Peachpit.

Human Security warned that the players behind Badbox don’t care who they target. Their malicious software targeted consumers in the private and public sectors worldwide.

While the malware group’s operations have since been disrupted, it was identified as far back as 2016. Moreover, adware isn’t the only thing to watch out for.

Through these vectors, threat actors could sell access to user home networks, install malicious code remotely, and create fake email and social media accounts to impersonate victims.

South Africans can buy a wide range of Google-certified and Apple TV streaming devices to access services like Netflix, Amazon Prime Video, and Showmax without worrying about malware.

Some “safe” Android TV device brands include QVWI, Xiaomi, MeCool, Blaupunkt, and, of course, Google itself.

You don’t need to break the bank to buy one of these devices, either. Prices for Google-certified Android TV devices range from around R699 to R1,700.

Meanwhile, Apple’s streaming devices are more expensive, with the 64GB Apple TV 4K priced at around R2,900 and the 128GB model coming in closer to R3,000.

The most affordable option listed is the QVWI 2K Leap L1 stick, priced at R699, followed by Xiaomi’s Mi TV Stick at R849. These are the only devices listed that don’t support 4K streaming.

The most affordable device capable of streaming in 4K resolution is the MeCool KD3 TV Stick, which is priced at R899.

Two Google Chromecasts are also listed: the Chromecast 3rd-generation and the Chromecast 4K, priced at R944 and R1,299, respectively.

As the name implies, the 4K Chromecast supports 4K streaming while the 3rd generation maxes out at 1080p.

The table below lists several Google-certified or Apple TV devices that South Africans can use without fear of the device stealing their sensitive information.