CYBERTVLAB
← All articles

Guide · By CYBERTVLAB ·

Is your TV box certified? How to check, and why it matters

Two streaming boxes can both say “Android TV” on the box and share almost nothing underneath. The difference has a name — certification — and it takes about two minutes to check which side yours is on.

Two devices, one label

“Android TV” is used loosely. A certified device is a specific hardware and software build that Google has tested and licensed. It ships with the genuine Play Store, the Google TV or Android TV launcher, and Google Play Protect — the built-in malware scanner. What certification confirms is the build: it passed Google’s compatibility testing. How long the manufacturer keeps it updated still depends on the manufacturer.

An uncertified box runs Android too — but as an open-source build assembled by the vendor, with a launcher that imitates the real thing. It has no license from Google, so it either ships without the Play Store or ships a copy that was never meant for it. It cannot receive Android security patches through Google’s pipeline, and the “updates” it does get come from whoever built the firmware.

To be fair to the category: not every uncertified device is a cheap box. Google lists unlocked bootloaders, modified system software, and rooting among the reasons an otherwise legitimate device can show up as uncertified. What matters for a box bought new is whether it was ever certified in the first place.

And certification status maps onto the biggest campaigns we know of. In our BadBox-to-Kimwolf article, the largest operations — BadBox and BadBox 2.0 — disproportionately hit low-cost, off-brand hardware; Google’s own description of the affected devices in its BadBox 2.0 lawsuit is Android’s open-source software, “which lacks Google’s security protections.” Certification lowers that supply-chain risk. It does not cover every infection path, and it is not a guarantee that any given device is clean.

The two-minute check

On the device itself, Google’s certification status is displayed in the Play Store:

  1. Open the Google Play Store app on the TV.
  2. Select your profile icon (top right).
  3. Go to Settings, then About.
  4. Find Play Protect certification.

It will read either “Device is certified” or “Device is not certified.” If the Play Store app is missing entirely, or refuses to sign you in, that is a strong signal — but not by itself conclusive, since a sideloaded copy can exist on an uncertified box. Google’s supported-devices list, below, is the next check.

If you are shopping rather than checking — or cannot get to the device — Google also publishes a list of supported devices (search the page for the brand and model), and the Android site keeps a certified-device overview.

What certification actually buys you

  • Play Protect malware scanning, built into Google Play services and on by default on certified devices. On an uncertified box, even a sideloaded copy of the Play Store often cannot run Play Protect properly.
  • The apps you expect to work are far more likely to work — including DRM-dependent streaming services, which rely on hardware security features that uncertified firmware frequently lacks. Individual services can still impose their own model, region, and hardware requirements.
  • A realistic update path — though not a guaranteed one. Certified devices get security patches through the vendor’s supported platform; how regularly depends on the vendor. An uncertified box may never see one.
  • A vendor with something to lose — a support page, a warranty, firmware downloads, and a name that can be held to a published update policy.

The honest caveat: certification is a strong signal, not a force field. Certified devices can still run old software if the maker abandons them, and Play Protect only helps if it stays switched on. It raises the floor; it does not remove the habits below.

Risk signals worth verifying

None of these proves a box is malicious, and none of them alone means a specific unit is affected — together, they are reasons to check the exact model and build before trusting it:

  • Alphabet-soup names — X96, MX10 and similar — or literally “TV BOX” as the product name.
  • A price far below any comparable brand-name device.
  • Marketing built on “free premium channels,” “fully loaded,” or “lifetime subscription included.”
  • Setup instructions that tell you to disable Play Protect or install an “app store” from a download link.
  • No manufacturer website, no firmware downloads, no stated Android version.

If your box is not certified

Uncertified does not automatically mean infected — it means unprotected by design. Concretely:

  • Do not sign into banking, password managers, or your primary email on that device.
  • Put it on a separate Wi-Fi network (a guest network works — verify it actually blocks access to your local network) so it does not share a segment with phones, computers, and NAS drives.
  • Remove any app you did not install yourself, and never disable Play Protect to make something install.
  • Treat unexplained behavior — unfamiliar traffic, apps you did not add, sluggishness without cause — as a reason to stop using it for anything sensitive.

And if the box shows signs of firmware-level compromise — preinstalled extras you never installed, unexplained traffic — uninstalling apps may not help: implants like these live in the system partition, and a factory reset may not remove them. Disconnect it from your network, stop using it for sensitive accounts, check whether the vendor publishes a clean, signed firmware, and replace the device if the chain of trust cannot be restored.

A certified streaming stick from a known brand costs less than most people expect, and it is the simplest way to close this entire chapter. A TV box is replaceable; what it has access to is not.

Sources

Deltavant is an on-device anti-malware app for Android TV and Google TV, currently in review with Google Play. Learn more about Deltavant.