My in-laws have a malicious Android device on their network at home. How can I prove it to them while I am visiting them for the holidays?

[-]

ZAFJB@reddit

Start with - how do *you* know it is there?

Reply

[-]

StoneyCalzoney@reddit

Guaranteed its one of the cheap chinese Android TV boxes that have been proven to be loaded with malware

Reply

[-]

ZAFJB@reddit

You guess doesn't tell us anything about why OP thinks/knows there is a device on the network.

Reply

[-]

??? OP: "Oh hey in-laws, I just read some article/watched some video which shows that these cheap streaming boxes can have malware, don't you have one of those" In-laws: "No ours is fine we got it from Amazon, the brand name is [insert random string here], has lots of good reviews and was very inexpensive, gives us a lot of free channels" OP: "What does it look like" In-laws: *Shows picture of a generic ODM Android TV box*

Reply

[-]

ZAFJB@reddit

You are still guessing.

Reply

[-]

StoneyCalzoney@reddit

Well OP confirmed my guess in the first comment you replied to... Regardless it doesn't matter how OP knows, whether thats by OP seeing it at their in-laws house or OP's in-laws telling OP about the purchase when the topic is brought up.

Reply

[-]

fireandbass@reddit (OP)

It is an android streaming box loaded with malware but my previous posts about it naming the device. were not approved, so that's why I'm being deliberately vague and not mentioning the product name.

Reply

[-]

jerminator4427@reddit

[/r/techsupport](https://reddit.com/r/techsupport)

Reply

[-]

fireandbass@reddit (OP)

I'm not asking for tech support, I'm wanting to know what other sysadmins would do to detect. I provided multiple solutions in my post. It's relevant to the subreddit.

Reply

[-]

jerminator4427@reddit

4. Wrong Community • There are many reddit communities that exist that may be more catered to/ dedicated your topic. • Requests for assistance are expected to contain basic situational information. - They should also contain evidence of basic troubleshooting & Googling for self-help. - Keep topics/questions related to technology/people/practices/etc within a business environment. • When asking a question or requesting advice, please update your original post with any new information, or solution (if found).

Reply

[-]

serverhorror@reddit

You're also not answering the most relevant question: What makes you think malicious and what proof do _you_ have it is malicious? What proof do you have your own device is not malicious? And, finally, in any professional setting you have to make the decision base simple for the audience you speak to. If you do not have any proof, how about: Hey I think that this thing is spreading viruses. Do you want me to take a look? I'll need it for X days and run an analysis. oK? If they decline, be respectful of the owners decision and enjoy the consequences of the decisions or be happy you were wrong and they can be happy customers.

Reply

[-]

Kumorigoe@reddit

Sorry, it seems this comment or thread has violated a sub-reddit rule and has been removed by a moderator. **Inappropriate use of, or expectation of the Community.** * There are many reddit communities that exist that may be more catered to/dedicated your topic. - Consider posting (or cross posting) there with specific niche questions. * Requests for assistance are expected to contain basic situational information. - They should also contain evidence of basic troubleshooting & Googling for self-help. - Keep topics/questions related to technology/people/practices/etc within a business environment. * When asking a question or requesting advice, please update your original post with any new information, or solution (if found). - This will make things easier for anyone else who may have the same issue or question in the future. ----- *If you wish to appeal this action please don't hesitate to [message the moderation team](https://www.reddit.com/message/compose?to=%2Fr%2Fsysadmin).*

Reply

[-]

fireandbass@reddit (OP)

That's really disappointing you would remove this. I'm a sysadmin and it feels more appropriate for here than for r/techsupport, especially with sysadmins going home for the holidays.

Reply

[-]

AnApexBread@reddit

Step 1. Don't. If your parents are anything like mine, they're never going to believe it, and all you're going to do is get frustrated. If you really want to fix it, buy them a new streaming box and "brick" the old one. Set a firewall rule to block all outbound traffic from the old device's MAC, so it seems like the device just suddenly stopped working.

Reply

[-]

stephenph@reddit

no need to PROVE it to them as there is little they can do about it. Change the wifi password each time you visit and POSSIBLY hide the ssid (only do that if you can be sure it will not cause issues for them down the road.) you can also block the mac address, but that is easily spoofed so will not stop them if they are determined. as mentioned, how do you know it is malicious and is it actually ON the network (as opposed to just showing up as a device that is available for a bluetooth pairing) if it is in the Bluetooth list just delete it. when I go to pair a new device I see my neighbors speaker and I also see their SSID in my available wifi list... most likely they will not even be able to pair/connect if that is the case

Reply

[-]

stephenph@reddit

no need to PROVE it to them as there is little they can do about it. Change the wifi password each time you visit and POSSIBLY hide the ssid (only do that if you can be sure it will not cause issues for them down the road.) you can also block the mac address, but that is easily spoofed so will not stop them if they are determined. as mentioned, how do you know it is malicious and is it actually ON the network (as opposed to just showing up as a device that is available for a bluetooth pairing) if it is in the Bluetooth list just delete it. when I go to pair a new device I see my neighbors speaker and I also see their SSID in my available wifi list... most likely they will not even be able to pair/connect if that is the case

Reply

[-]

Panda-Maximus@reddit

You'd have to have access to the router, check the arp tables, compare that to the switch or wifi mac address table, use the mac oui to MAYBE find out what it is (since spoofing is super easy), then find the physical device. Alternatively, with same access, and assuming the router supports it, inventory every physical device and create a mac filter allowing only those. Most ISP supplied routers cant do this, and honestly if their wifi is at default of with a boneheaded pwd the actual device could be next door. My head scratcher is how you are convinced they have a bad actor without already doing some of this.

Reply

[-]

Glittering_Wafer7623@reddit

Start by getting a business grade firewall and EDR for your in-laws. Imagine how much extra work you can give yourself that nobody will understand or appreciate! /sarcasm, sort of

Reply

[-]

Cmd-Line-Interface@reddit

this made me chuckle.

Reply

[-]

StoneyCalzoney@reddit

Don't prove it, just get them a better, non-malicious one as a gift.

Reply

[-]

MrITSupport@reddit

Most routers when you login as admin to them, will provide you a list of devices connected to the network. Most of those routers (if provided by the provided) have the admin login / password on sticker on the device itself.

Reply

[-]

lrosa@reddit

Don't do that. Use your mobile data and live happy,

Reply

[-]

StormlitRadiance@reddit

Don't do free work for you inlaws.

Reply

[-]

Karmachinery@reddit

The logs on the local router should give you some indicator. Do a search for the first six characters in the MAC to see what the manufacturer is...which may not be useful if it's some random device using a readily available wireless NIC internally.

Reply

[-]

elephantLYFE-games@reddit

1st - don’t.

Reply

[-]

PolMacTire@reddit

For context, what is giving you the the belief that it is malicious in the first place?

Reply

My in-laws have a malicious Android device on their network at home. How can I prove it to them while I am visiting them for the holidays?

Reply to Post

26 Comments

ZAFJB@reddit

StoneyCalzoney@reddit

ZAFJB@reddit

StoneyCalzoney@reddit

ZAFJB@reddit

StoneyCalzoney@reddit

fireandbass@reddit (OP)

jerminator4427@reddit

fireandbass@reddit (OP)

jerminator4427@reddit

serverhorror@reddit

Kumorigoe@reddit

fireandbass@reddit (OP)

AnApexBread@reddit

stephenph@reddit

stephenph@reddit

Panda-Maximus@reddit

Glittering_Wafer7623@reddit

Cmd-Line-Interface@reddit

StoneyCalzoney@reddit

MrITSupport@reddit

lrosa@reddit

StormlitRadiance@reddit

Karmachinery@reddit

elephantLYFE-games@reddit

PolMacTire@reddit