Live data from Hacker News

Read this before you buy that TV streaming stick

krebsonsecurity.com

211–220 of 575 posts

Re: Read this before you buy that TV streaming stick

#211

> Despite repeated warnings from the FBI and security industry leaders about the security and privacy risks of using these streaming devices, major e-commerce providers like Amazon, Best Buy, Newegg and others continue to sell hundreds of different models and brands I scanned the comments and I didn't see anyone suggesting that these companies should share any responsibility for selling these harmful products. Why is…

Probably because we have little to no way to punish those companies. We can't even stop DJI from shipping their drones under other brands to get around the ban.

Our government chooses to not punish those companies. Unfortunately, the lawmakers have decided that the donations to their PACs are more important than actually doing something about it.

Re: Read this before you buy that TV streaming stick

#212

I do not see problems with fake ad clicks and have no sympathy for ad companies. Also pre-installed adware is not a surprise, I found adware in the official firmware image of a certain Chinese tablet. What worries me much more is backdoors from the foreign companies and governments that can be pre-installed at the factory to collect intelligence information. For example, I became aware that a certain maker of a popul…

> What worries me much more is backdoors from the foreign companies and governments that can be pre-installed at the factory to collect intelligence information.

The Snowden leaks showed that the US was already doing this. I'm certain that everything purchased is already infected with something. Most likely bugs and bad security.

Re: Read this before you buy that TV streaming stick

#213
LG televisions and monitors spy on their users and install unwanted software. Half of all smart tvs are running "residential proxy" malware. Google is banning sideloading but happily hosting apps using the Bright SDK.

Sorry, but "your tv stick does ad fraud" is just about the most innocent thing I've seen in a while. Everyone in this market is doing the shadiest shit you can imagine. There are no good brands left, you just get to pick what logo your Malware Entertainment Device has.

Re: Read this before you buy that TV streaming stick

#214

> Despite repeated warnings from the FBI and security industry leaders about the security and privacy risks of using these streaming devices, major e-commerce providers like Amazon, Best Buy, Newegg and others continue to sell hundreds of different models and brands I scanned the comments and I didn't see anyone suggesting that these companies should share any responsibility for selling these harmful products. Why is…

Just being realistic here; many of these are of Chinese make so how exactly would you stop it other than blocking them from being sold. They certainly don't advertise to the big box retailer that buys them "and it uses the customer's internet connection for fraud." Hell, there's a section of comments that would probably going "hey, RELAX guy" because it's not US companies doing this. For any American companies that d…

> Just being realistic here; many of these are of Chinese make so how exactly would you stop it other than blocking them from being sold.

You already answered it: block it from being sold.

1) Make Amazon responsible for the products they are selling. 2) Introduce a law banning malware tv sticks 3) Sue Amazon for a percentage of their yearly revenue when caught violating it 4) Amazon will finally start caring and do some kind of review on the crap they sell.

Re: Read this before you buy that TV streaming stick

#215

Earlier quoted context omitted.

Upon connecting it to the internet… I hesitate to blame the victim here, but why on earth would you do that? “$40 Chinese-made” didn’t give you pause?

To be fair, everything is Chinese made. I would be even the Apple TV and NVIDIA Shield are made in China and if a state actor is determined to get a malicious payload in....

My Samsung phone is made in Vietnam.

Re: Read this before you buy that TV streaming stick

#216

That reminds me, I need to configure VLANs in my router so that all my trusted computers are isolated from all the other garbage that makes it into the network.

Mmmh, I've always wondered ... as much as VLAN's are a very useful tools to - for example - route two separate LAN's traffic through a shared physical link ... are they any good when it come to security? I mean, I don't believe VLAN's were designed with security as a goal, and I wonder how "strong" the virtual wall between two VLAN's actually is? Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physica…

this is a good question, i asked claude sonnet 5 and the answer is too big and complex for me to type out on mobile. but long story short, you absolutely need separate VLANs and Firewalls in conjuction to secure traffic between networks

Re: Read this before you buy that TV streaming stick

#217

Earlier quoted context omitted.

Just being realistic here; many of these are of Chinese make so how exactly would you stop it other than blocking them from being sold. They certainly don't advertise to the big box retailer that buys them "and it uses the customer's internet connection for fraud." Hell, there's a section of comments that would probably going "hey, RELAX guy" because it's not US companies doing this. For any American companies that d…

But it is a retailer's responsibility to know what they are selling. If it was added after they started selling it and hidden in secret, sure a retailer might have an excuse. But it isn't really hidden, most often its put in their marketing materials as a benefit and have been knowingly doing it for many years now. US retailers can be told they can't sell it here. If you buy it outside of that, well that is buyer bew…

The problem is that Amazon, Walmart & friends have said the "we are a platform, not a retailer" magic incantation, which means that through the power of friendship and unicorns they are now suddenly no longer responsible for the stuff they sell.

And the "retailer" on record is of course not a real company. They'll just pay some third-party to file a bunch of paperwork in Delaware, pay the $110 fee, and let it go bust if anyone tries to investigate it or make it liable.

Re: Read this before you buy that TV streaming stick

#218
post #108

We purchased a Chinese-made projector from Amazon, which was surprisingly inexpensive (~40 USD). Upon connecting it to the internet, it placed a constantly running feed of ads on the corner of the screen, even while movies were playing. There was no way to disable it either. Even though it's not a stick, it's a similar principle.

Capitalism!

Absolutely, there's no scam outside capitalism!

Re: Read this before you buy that TV streaming stick

#219

After getting tired of ads on my PAID smart TV, 6 months ago I started building a casting device using raspberry pi for myself. A couple of months later one of my friends who is an AV technician ended up using it at the largest convention venue in Barcelona to play content on loop, here's a video of that: https://www.youtube.com/shorts/FF3I9EOs4AA . Fast forward to last month, now I have started selling these in Barc…

Clicked on the link, ready to buy one. “Contact sales”. Ew. No thanks.

We are literally new and only available in Barcelona at the moment which I mentioned in my comment as well. Not sure what's eww about that?

Re: Read this before you buy that TV streaming stick

#220

> Despite repeated warnings from the FBI and security industry leaders about the security and privacy risks of using these streaming devices, major e-commerce providers like Amazon, Best Buy, Newegg and others continue to sell hundreds of different models and brands I scanned the comments and I didn't see anyone suggesting that these companies should share any responsibility for selling these harmful products. Why is…

One of the main value propositions for retailers in a world of endless cheap garbage being sold online, is to vet products so customers can trust that what their buying is from a legitimate company and not junk or stuff like these streaming sticks. This is the problem with being an “everything store”. “Everything” includes a lot of things most consumers would like to be protected from, and assume they are due to the…

interesting bit of information: most EV mower companies now do not provide replacement parts - if a mower dies within warranty, a 'certified' warranty repair shop does basic troubleshooting, and if it's beyond a piece of cheap plastic, the mfr just ships a new mower to the 'repair shop'. Once out of warranty, you're on your own.
Post reply on HN