Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Read this before you buy that TV streaming stick

krebsonsecurity.com

Post reply on HN
Print view View original

131–140 of 575 posts

Re: Read this before you buy that TV streaming stick

#131

Post by bigmattystyles »

mikestew wrote: post #115
simojo wrote: post #108

We purchased a Chinese-made projector from Amazon, which was surprisingly inexpensive (~40 USD). Upon connecting it to the internet, it placed a constantly running feed of ads on the corner of the screen, even while movies were playing. There was no way to disable it either. Even though it's not a stick, it's a similar principle.

Upon connecting it to the internet… I hesitate to blame the victim here, but why on earth would you do that? “$40 Chinese-made” didn’t give you pause?

To be fair, everything is Chinese made. I would be even the Apple TV and NVIDIA Shield are made in China and if a state actor is determined to get a malicious payload in....

Re: Read this before you buy that TV streaming stick

#132

Post by mschild »

bayarearefugee wrote: post #112
1970-01-01 wrote: post #16

Earlier quoted context omitted.

No, and that's is the root of the problem. The buyer is happy and so is the seller. They don't care to understand what they're allowing and everyone is allowing it to happen.

I wouldn't use a device like this for a lot of reasons, but the fact that what they are doing might be taking advantage of the incredibly predatory digital advertising system is neutral to positive for me, if I'm being fully honest. If they were using the system to rip off random people, I'd be 100% against it, if they are fucking Google and the giant corps that advertise with them, ehh.. not my problem and can't be…

Wouldn't this ultimately make money FOR Google and only cost money to the company that placed the ad?

Sure, Google's paying but they get their money regardless.

Re: Read this before you buy that TV streaming stick

#133

Post by dpoloncsak »

frollogaston wrote: post #125
mortenjorck wrote: post #3

In this case it’s actual malice, that the streaming stick is set up for residential proxy and ad fraud straight from the factory. But incompetence can lead to the same place if it’s a poorly engineered, un-maintained device with an old version of Android that will never be patched and is always one no-click exploit away from being commandeered into residential proxy and ad fraud.

Since these are poorly engineered, wonder how easy it'd be to reverse-engineer one and just get the free streaming on a non-scam device.

If it's something like a Firestick (or the knock-off featured in the article), you're really just connecting to Content Provider servers to handle auth and content streaming, right? They're just OSes designed to run Netflix and Hulu. Would be hard to spoof I think

Re: Read this before you buy that TV streaming stick

#134

Post by zeafoamrun »

floam wrote: post #106
havaloc wrote: post #11

Earlier quoted context omitted.

I have an elderly client who sends me links of stuff to buy all the time. One day it's one of these streaming sticks, the next day it's half-price stamps, and I tell her every time, please don't buy this stuff. And yet she does anyway, as if I was almost being mean and saying no just to say no. So yes, I do want to blame the purchasers of these things, sometimes. To prove her point that her stamps were legitimate, sh…

Half priced stamps work though, and nobody is going to prosecute grandma for counterfeiting postage stamps.

Yes they do. USPIS does not f around

Re: Read this before you buy that TV streaming stick

#135

Post by labbett »

FinnKuhn wrote: post #18
mortenjorck wrote: post #3

In this case it’s actual malice, that the streaming stick is set up for residential proxy and ad fraud straight from the factory. But incompetence can lead to the same place if it’s a poorly engineered, un-maintained device with an old version of Android that will never be patched and is always one no-click exploit away from being commandeered into residential proxy and ad fraud.

Those TV streaming boxes really are (from a cybersecurity perspective) probably one of the worst things you can buy. Here is the "Darknet Diaries" Episode on them: https://darknetdiaries.com/episode/172/

Superbox 3 is coming up at DEF CON next Friday!

https://hackertracker.app/defcon34/content/67257

Re: Read this before you buy that TV streaming stick

#136

Post by deepfriedbits »

ta988 wrote: post #127

A familly member had one of those (he had to pay a yearly subscription in addition to the stick). Network would be unusable as soon as it was on for anyone else, and it also tried to scan things on the local network. It was indeed connecting to all kind of services all over the world (and saturating some tables in the router doing so which blocked other clients). Definitely evil, definitely on purpose.

Reading this, I caught myself wondering how we distill what's in this excellent write up into something the average consumer understands, including the dangers from buying and using devices like this.

Is it a graphic that's shared? Something else? I am sure we all know or have heard of people with these devices that promise free streaming.

Re: Read this before you buy that TV streaming stick

#137

Post by mikepurvis »

dpoloncsak wrote: post #133
frollogaston wrote: post #125

Earlier quoted context omitted.

Since these are poorly engineered, wonder how easy it'd be to reverse-engineer one and just get the free streaming on a non-scam device.

If it's something like a Firestick (or the knock-off featured in the article), you're really just connecting to Content Provider servers to handle auth and content streaming, right? They're just OSes designed to run Netflix and Hulu. Would be hard to spoof I think

Indeed. Owning the streaming box lets you loose on whatever network it's on, but it doesn't actually get you inside the content gardens; those are separately managed by teams of people much more motivated to protect their IP.

Re: Read this before you buy that TV streaming stick

#138

Post by ta988 »

deepfriedbits wrote: post #136
ta988 wrote: post #127

A familly member had one of those (he had to pay a yearly subscription in addition to the stick). Network would be unusable as soon as it was on for anyone else, and it also tried to scan things on the local network. It was indeed connecting to all kind of services all over the world (and saturating some tables in the router doing so which blocked other clients). Definitely evil, definitely on purpose.

Reading this, I caught myself wondering how we distill what's in this excellent write up into something the average consumer understands, including the dangers from buying and using devices like this. Is it a graphic that's shared? Something else? I am sure we all know or have heard of people with these devices that promise free streaming.

I warned them about the risk of those things and showed them what I found, they continued buying the next generation (that person and his two >40yo kids). They NEEDED to watch those soccer games more than they cared about security...

Re: Read this before you buy that TV streaming stick

#139

Post by nvme0n1p1 »

weberer wrote: post #92
nvme0n1p1 wrote: post #12

Earlier quoted context omitted.

OTOH - TV, radio, and YouTube are all unlimited and free. Why not streaming? There are lots of people alive who grew up during the days of broadcast TV and radio. I get why they might not understand the difference.

There are a ton of legitimately free IPTV streams. You can watch them through most media players like VLC without having to download anything shady. https://github.com/iptv-org/iptv

Ok but have fun explaining that to the average person. Buying a dongle is easier than installing software or typing URLs into their TV ("my TV doesn't even have a keyboard").

To most people IPTV is a bunch of gibberish letters, indistinguishable from the gibberish brands on Amazon. Someone's grandma from Colorado doesn't deserve to get scammed because she didn't research the acronyms.

Re: Read this before you buy that TV streaming stick

#140

Post by knowaveragejoe »

giantg2 wrote: post #19

So where can I get an actual privacy focused streaming box, even if the apps (Neflix etc) running on it are not?

The Onn TV devices from walmart seem fine, baseline google tracking not-withstanding... but no residential proxy or botnet participation without you knowing! You can just block them at the router and stream content locally.
Post reply on HN