18 ms·

Read this before you buy that TV streaming stick

818 points by speckx 3mo ago

bronko_nagurski 3mo ago
[dead]
mortenjorck 3mo ago
In this case it’s actual malice, that the streaming stick is set up for residential proxy and ad fraud straight from the factory. But incompetence can lead to the same place if it’s a poorly engineered, un-maintained device with an old version of Android that will never be patched and is always one no-click exploit away from being commandeered into residential proxy and ad fraud.
- alex_duf 3mo ago
  I wonder to what degree malice can be engineered to look like incompetence?
  - abbeyj 3mo ago
    Try examining the old entries from the https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest.
- FinnKuhn 3mo ago
  Those TV streaming boxes really are (from a cybersecurity perspective) probably one of the worst things you can buy. Here is the "Darknet Diaries" Episode on them: https://darknetdiaries.com/episode/172/ https://darknetdiaries.com/episode/172/
  - labbett 3mo ago
    Superbox 3 is coming up at DEF CON next Friday! https://hackertracker.app/defcon34/content/67257 https://hackertracker.app/defcon34/content/67257
    - doctorspazz 3mo ago
      Thank you for sharing this. The superbox investigations have been incredibly interesting to follow.
- frollogaston 3mo ago
  Since these are poorly engineered, wonder how easy it'd be to reverse-engineer one and just get the free streaming on a non-scam device.
  - dpoloncsak 3mo ago
    If it's something like a Firestick (or the knock-off featured in the article), you're really just connecting to Content Provider servers to handle auth and content streaming, right? They're just OSes designed to run Netflix and Hulu. Would be hard to spoof I think
    - mikepurvis 3mo ago
      Indeed. Owning the streaming box lets you loose on whatever network it's on, but it doesn't actually get you inside the content gardens; those are separately managed by teams of people much more motivated to protect their IP.
  - kiririn 3mo ago
    See CoreELEC/LibreELEC/etc - totally replaces the (potentially dodgy) Android OS on these kind of streaming boxes with a stripped down Linux+Kodi setup
    - qmr 3mo ago
      I thought those were for x86? They run on ARM TV boxes / sticks now?
      - tesnorindian 3mo ago
        LibreElec also supports ARM builds than can run on SBC like Raspberry Pi. While CoreElec is exclusively for Amlogic ARM processors.
  - wildzzz 3mo ago
    Best case, you can grab the credentials off the Kodi box and use them on a clean install. Worst case, everything is packaged up in a single app so it's all or nothing. Although you could just wipe the box and find another pirate TV provider.
- acdha 3mo ago
  I was trying to figure out why we saw so many fraudulent applications from Vietnam for a service which is restricted to the United States, especially because they were all getting rejected - it seemed like even the laziest spammer would lose interest in something they couldn’t monetize. A guy in Vietnam mentioned that one of the largest ISPs there used these really dodgy Chinese modems which were so notoriously insecure that it was apparently common knowledge that you should replace them if performance was slow because that was a sign that yours was being used by a botnet. Apparently the cost of access to one of those nodes was so low that the spammers don’t even really monitor their bots.
- 8note 3mo ago
  consumers are however happy to buy a cheaper stick with an overall public bad
  - inigyou 3mo ago
    I don't even think it's a public bad. I think attacking internet gatekeepers like Cloudflare is objectively a public good. So is attacking legal spam companies.
    - psd1 3mo ago
      ...ish. Attacking their monopoly, great. Attacking their workers by bombing an office, not so great. Throwing ever more spam traffic across the tubes isn't a attack, it's marketing on their behalf.
      - inigyou 3mo ago
        In what way is clicking an ad like bombing an office?
        psd1 3mo ago
        I think i was clear, but I'll try again. You said this: > attacking internet gatekeepers I think we agree that you don't mean all kinds of attack. The agreed exception is bombs. I put it to you that throwing bot traffic around is another kind of attack that you do not want, because it drives product sales. You would be doing them a favour.
- inigyou 3mo ago
  What is the malice in those things?
glitchc 3mo ago
Defrauding ad networks doesn't seem like a bad thing, although using my internet connection as a proxy is obviously terrible. It wouldn't surprise me to learn that my connection is being sold as a VPN service by the vendor.
- alistairSH 3mo ago
  It'll be a marginal effect, but fake clicks impacts the ad buyer, which then impacts their financials and pricing. The only winner here is the scammers running the fake affiliate sites on which these sticks are "clicking". Or, am I missing some facet of this enterprise?
  - ssl-3 3mo ago
    Another winner is the person who gets to watch cheap digital TV, without putting together a usable antenna and limiting their reception to the broadcast channels that are nearby. I mean: They just pay the money, plug the thing in, push some buttons, and: TV happens. Right?
    - snickerbockers 3mo ago
      Theres the question of whether or not the fraudulent advertisement clicking is using enough traffic to inconvenience or impose fees upon the user but otherwise I agree with you and am tempted to buy one just to fuck with advertisers. Backdoors and spying are also a problem in theory except at this point you can't even trust "legitimate" companies on that front so it's a moot point.
      - acdha 3mo ago
        > otherwise I agree with you and am tempted to buy one just to fuck with advertisers. How that actually works in practice is that your favorite sites make less money and your IP gets a bad reputation so you CAPTCHAs or outright blocked. There’s no “sticking it to the man” here, just contributing to the frictional grind making the internet worse for ordinary people.
skinfaxi 3mo ago
Thankfully this seems limited to a specific device (H96). Darknet diaries has a good story about streaming devices https://www.youtube.com/watch?v=dS6PkuZuxJ4 https://www.youtube.com/watch?v=dS6PkuZuxJ4
- krebsonsecurity 3mo ago
  It's not just one device line; Have a look at the list maintained by the proxy tracking service Synthient, which tracks streaming boxes, digital picture frames and other IoT devices that have been known to bundle residential proxy software, among other malicious apps. They currently track almost 1,000 different makes and model numbers. https://github.com/synthient/public-research/blob/main/2026/01/kimwolf/product_names.csv https://github.com/synthient/public-research/blob/main/2026/...
pavel_lishin 3mo ago
> generic TV boxes that promise unlimited content streaming for a one-time fee I don't want to blame the purchasers of these things - who are some of the victims - but at the same time, it does seem like a Too Good To Be True situation.
- croes 3mo ago
  It sounds like scam
- havaloc 3mo ago
  I have an elderly client who sends me links of stuff to buy all the time. One day it's one of these streaming sticks, the next day it's half-price stamps, and I tell her every time, please don't buy this stuff. And yet she does anyway, as if I was almost being mean and saying no just to say no. So yes, I do want to blame the purchasers of these things, sometimes. To prove her point that her stamps were legitimate, she mailed me a card using one of her half priced (but likely fake) stamps and it made it through!
  - Terr_ 3mo ago
    Perhaps they grew up in a time/environment where "if it was that bad they wouldn't be allowed to advertise it", and they're still using that old calibration?
    - mhurron 3mo ago
      My falther-in-law was less that and more, if I can get away with it, it's actually legal. Many know their fake, and do it because they can get away with it. That was his justification for a satellite descrambler, they're sending me the signals, obviously I'm allowed to.
      - mmooss 3mo ago
        I can imagine many on HN having excited discussions about their satellite descramblers. > do it because they can get away with it. Lots of people on HN download and upload copyrighted materials. Is it really different?
giraffe_lady 3mo ago
> allowing low-skilled operators to drag blocks of code together in their editor — without any need to understand what the underlying code blocks do or how they work. We're called engineers brian.
cryo32 3mo ago
A better solution is just leech the content and stick it on a generic USB flash stick.
- harvey9 3mo ago
  These are popular for illegal live sports streams.
  - cryo32 3mo ago
    I just go down the pub.
j45 3mo ago
Generally, it's advisable to create a dedicated wifi network for all potentially hostile devices. This dedicated wifi network can just be connecting your devices to your guest wifi while you figure it out, and limiting the rate of speed as needed. That can be cameras, tv's, thermostats, tv sticks and anything else that might not only call home, but actively scope what you have in your home network when it's none of it's business.
- spelk 3mo ago
  I don't think this would make a big difference for the threat model described in the OP? They'd still be able to use your IP Address and potentially do nefarious things through your role as an unwitting proxy.
  - j45 3mo ago
    Using one device as a proxy is a few steps away from trying to exploit and infiltrate the other devices on your machine as well. An unwitting proxy is already crossing the line to putting a fox in the henhouse. Limiting what outbound access devices can/can't have is an important skill to learn.
- drnick1 3mo ago
  > That can be cameras, tv's, thermostats, tv sticks and anything else that might not only call home That is not enough. You need to air gap devices that have legitimately no business communicating with anyone or anything outside the house. TVs, thermostats, and other Internet-of-Crap gadgets do not need "firmware updates." Either they work out of the box, offline or within the LAN, or they get sent back for a refund wherever they came from.
  - j45 3mo ago
    Agreed. That usually comes as a step after getting these items on a separate SSID.
giantg2 3mo ago
So where can I get an actual privacy focused streaming box, even if the apps (Neflix etc) running on it are not?
- cogman10 3mo ago
  I'm increasingly being convinced the only way to do that is you do a media pc nuc. The problem, of course, is you probably won't have the netflix app. It's painful to setup such a box to stream from various services.
  - mbmbn 3mo ago
    I tried going that route, but most apps for streaming are Android. And that was only one of the issues. It was a rabbit hole and in the end I got back using my NVIDIA Shield. This is about 10 years now, but it’s actually still the best option.
  - Tepix 3mo ago
    What's wrong with Apple TV? It runs VLC if you want to stream something from your NAS.
  - giantg2 3mo ago
    I tried to look at setting up an stripped down privacy-focused Android based box for Netflix, but ran into issues. Seems like you need to be spied on to run Netflix.
  - dwaltrip 3mo ago
    What about just using the Netflix desktop website? Or does that limit the resolution?
- MattTheRealOne 3mo ago
  Apple TV is currently the best balance of privacy and convenience. The only way to get more private is using a PC, but that limits the resolution for most streaming services to 720p or 1080p.
m3047 3mo ago
Brazil. Last year I effectively blocked Brazil for a while. Ultimately I settled on three possibilities for the traffic I was seeing: 01: DDOS 10: Residential proxies 11: Somebody DDOSing residential proxies
- drdexebtjl 3mo ago
  I can’t prove it, but I live in Brazil and after getting a smart TV from LG, I started receiving challenges across all Google services, indicating they received bot traffic from my network. I only used apps from streaming services I actually paid for. I suspect these TVs either come with residential proxies set up from the factory, or they have such poor security that they’re instantly hacked. Either way, TV manufacturers (including reputable ones like LG) are to blame.
  - mikestew 3mo ago
    There have been articles lately about the residential proxies loaded in apps for LG TVs. My LG has never seen a network connection, so I’m fuzzy on details.
  - inigyou 3mo ago
    LG has been in the news just this week for a whole lot of shady practices, which cast light on their other shady practices. Yes, residential proxying is one of them. I don't think residential proxying is all that shady since groups like Cloudflare have made it a necessity. However, having it out-of-the-box on a name-brand device is extremely shady.
codedokode 3mo ago
I do not see problems with fake ad clicks and have no sympathy for ad companies. Also pre-installed adware is not a surprise, I found adware in the official firmware image of a certain Chinese tablet. What worries me much more is backdoors from the foreign companies and governments that can be pre-installed at the factory to collect intelligence information. For example, I became aware that a certain maker of a popular mobile OS was collecting the cell tower IDs and WiFi access point identifiers along with GPS coordinates of a device. Obviously they collect this information to be able to guide missiles and drones when GPS signal is jammed (GPS is very low power and easy to jam). This is not acceptable. How can we prevent this? I think, for every imported device having a CPU and Internet connectivity: - the user must be able to re-flash firmware with their own code. - the local government must have access to the full source code and be able to search for vulnerabilities or backdoors, including using AI tools. Found vulnerabilities are considered a reward and may be used against countries not doing inspections. No access - no import permission. - any telemetry or data collection, or updates must be opt-in only and disabled by default. - any telemetry or updates must go through a server controlled by the local government, in unencrypted form, to detect attempts to collect intelligence information or install malicious update. Sadly our government instead only demands that manufacturers pre-install their closed-source software on all imported devices and that's all.
- BoppreH 3mo ago
  > a certain maker of a popular mobile OS was collecting the cell tower IDs and WiFi access point identifiers along with GPS coordinates of a device. Obviously they collect this information to be able to guide missiles and drones when GPS signal is jammed Is this sarcasm? GPS can take several minutes to get a location, and works poorly indoors. One of the reasons why Google Maps is so quick and precise is because Google has gathered exactly this data through users and Street View drive-bys. Could it be used for missiles? Sure. Is it obviously the intention? No.
  - meatmanek 3mo ago
    Yeah this is extremely standard: Apple: https://support.apple.com/en-us/102515 https://support.apple.com/en-us/102515 > If Location Services is on, your device will periodically send the geo-tagged locations of nearby Wi-Fi hotspots and cell towers to Apple to augment Apple's crowd-sourced database of Wi-Fi hotspot and cell tower locations. Google: https://support.google.com/android/answer/15157297?sjid=16484070620133019469-NC https://support.google.com/android/answer/15157297?sjid=1648... > When Location Accuracy is on, Google periodically collects information about the locations of wireless signals and sensors observed by your device to crowdsource location estimates. This helps everyone find locations better. Mozilla used to run a very similar service: https://en.wikipedia.org/wiki/Mozilla_Location_Service https://en.wikipedia.org/wiki/Mozilla_Location_Service Not to mention truly crowd-sourced databases like wigle.net.
Mistletoe 3mo ago
I recently got an Apple TV 4K and have been really enjoying the ad free experience. Worth every penny. Our smart tv had turned into a Christmas tree of ads.
- ocd 3mo ago
  As much as I hate Apple for what they've done to the average consumer in regards to computing, it would be just impossible and dishonest to say anything other than Apple is the outright winner in streaming devices. The experience is so smooth.
  - ghostly_s 3mo ago
    Considering their recent decision to give up on building Apple Maps into a serious contender and instead enshittify it with ads, I don't have much faith Apple TV will be far behind.
    - dhosek 3mo ago
      One hopes that the new CEO will realize the turn towards ads is ruining the Apple brand and pull back on that front.
      - inigyou 3mo ago
        Ha! No company has ever reversed enshittification.
        dhosek 3mo ago
        Although Apple did undo the touchbar (although I think they gave up on it too soon—I actually liked it once they restored the esc key. I can never remember what all the F-keys are supposed to do and getting an app-specific set of graphical choices made more sense to me.
  - trouve_search 3mo ago
    The nvidia shield is pretty damn good as well, even if old at this point.
AlotOfReading 3mo ago
Of all the evils normally associated with visual programming languages, enabling cybercrime isn't one I've previously considered. Now that I've seen it, I'm surprised it wasn't more common before LLMs appeared.
defmetrix 3mo ago
I didnt know anybody bought a streaming stick anymore
yunnpp 3mo ago
And which part of "ad fraud" is the fraud? As far as I can tell, ad networks and advertisers are the fraud and they are also part of the increasing surveillance state. Didn't know Krebs was a mainstream news puppet.
- brainwad 3mo ago
  It's called fraud because the ad host colludes with (or directly controls) the botnet to get lots of clicks on ads hosted on their sites, making them money at the expense of advertisers. If you just want to spam clicks on ads you don't financially be edit from, go for it.
yumraj 3mo ago
Any way to identify or block these proxy and ad click services in the router? Say a Ubiquiti or even pfsense? I’m not using any of these boxes for especially this reason, but about 10-15 years ago had noticed my treadmill pinging a Chinese portal. I removed the WiFi access from the treadmill but am curious if there might be other devices. Any specific ports, etc these guys use or are they mostly impossible to distinguish from regular internet traffic? My another worry has been if these can monitor other Internet traffic, though I think HTTPS should mostly prevent that.
utopiah 3mo ago
I bet this is much broader than we all realized because just earlier today I was reading on https://gist.github.com/probonopd/3ad6b7777caea1503f00d5fe7710ad06#adb https://gist.github.com/probonopd/3ad6b7777caea1503f00d5fe77... in order to tinker with a cheap (like really cheap) Android video projector : "Device: Magcubic HY300 Pro Android Projector (ui_Veng.projector) Issue: Device was being used as a residential proxy node without consent, causing thousands of suspicious DNS requests and bandwidth usage." linked in there just few months ago. It's not present on mine (AFAICT) which lead me to think either it was a genuine mistake or their bailed on that benefit or they upgraded to a harder to detect technique. An acquaintance mentioned they also bought a similar device few months ago. I believe there will be a lot MORE of these so we should soon be able to witness if it's an innocent mistake or the new normal.
- LetsGetTechnicl 3mo ago
  Oh wow that's the same projector I have. Would be really cool to install a custom build on it, but for now I just have an Apple TV connected to it.
  - utopiah 3mo ago
    You can already adb connect in dev mode then install .apks, e.g. termux, Fennec and change some settings. It does seem rootable but I didn't try.
stronglikedan 3mo ago
> But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks. You had me at "But"! ::swoon::
RajT88 3mo ago
A pirate TV box from China presents a security threat? This is my surprised face.
- inigyou 3mo ago
  No actual security threat was stated in TFA though. Only revenue threats.
gxs 3mo ago
No mention of Roku I use one but only when traveling at hotels - it’s one of the only sticks that can connect to captive WiFi networks at hotels I’ve got barely anything on it so privacy be damned - but at this point this is why I just buy apple products I have two apple tv’s which probably do shady things too, but I’m willing to play the probabilities and assume it’s the least bad of my options short of tinkering with flashing hardware and all that stuff that used to be fun in my teens (emphasis on used to)
kazinator 3mo ago
> But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads ... Compromised (or malicious from the factory) devices being recruited into bot farms for click fraud is ... a groundbreaking discovery in 2026? > on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks. To hell with AI-generated websites and advertising networks. Say, where can I get the most effective malicious TV stick for click-frauding the fuck out of that shit? I will take fifteen! :)
- snickerbockers 3mo ago
  I'm imaging a largescale distributed project like folding@home except instead of doing scientific research everybody is working together to fuck with advertisers, tracking cookies, etc.
cute_boi 3mo ago
The best solution to this problem is to block GeoIP traffic and monitor bandwidth consumption on a per-domain basis. If something is sending data during the night, it becomes much easier to identify suspicious activity.
Hasz 3mo ago
Hey that’s pretty smart! Fradulent, but very smart. I was honestly expecting botnet. I expect many cameras of “dubious” origin are used for similar tasks, same with most “smart” devices with sufficient horsepower.
Pxtl 3mo ago
> major e-commerce providers like Amazon, Best Buy, Newegg and others continue to sell hundreds of different models and brands that bundle unofficial versions of Google’s Android operating system and are frequently marketed (via online influencers) as a way to access a broad array of streaming services and live broadcasts without a subscription. This is why I giggle when people talk about ending Section 230 in the USA (or various international counterparts thereof). The largest companies on Earth are happily selling hacked piracy spyware botnet garbage. Not just hosting malicious posts for free like Section 230 protects, but selling illegal physical devices and taking a cut of the profit and excusing it with a pathetic whack-a-mole moderation system. It's already illegal and the law has already failed. Sean Parker's mistake was that he wasn't rich enough. Laws are for poor people.
a-dub 3mo ago
it's just like a phone. don't buy a crappy one with firmware of unknown provenance. make sure the one you do buy has an active and effective effort that you trust that ships timely security fixes.
matheusmoreira 3mo ago
That reminds me, I need to configure VLANs in my router so that all my trusted computers are isolated from all the other garbage that makes it into the network.
- ur-whale 3mo ago
  Mmmh, I've always wondered ... as much as VLAN's are a very useful tools to - for example - route two separate LAN's traffic through a shared physical link ... are they any good when it come to security? I mean, I don't believe VLAN's were designed with security as a goal, and I wonder how "strong" the virtual wall between two VLAN's actually is? Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel? Just wondering.
  - ahahs 3mo ago
    this is a good question, i asked claude sonnet 5 and the answer is too big and complex for me to type out on mobile. but long story short, you absolutely need separate VLANs and Firewalls in conjuction to secure traffic between networks
    - matheusmoreira 3mo ago
      Yeah, I've been using Claude to help me secure my home network. I applied to Anthropic's cyber program and got accepted despite being a hobbyist. I'm not very good at networks so I'm gonna try to make the most of it. Really wish I could point Mythos at my router and just loop it until my router becomes literally unhackable.
      - TylerE 3mo ago
        Making your router unhackable is trivial. Just pull the AC cord. You didn't specify that it had to be useable.
  - rcoder 3mo ago
    Depends on your networking setup. A good switch will simply refuse to route packets between clients on different VLANs, and hide the existence of the tags that determine which VLAN a host is on. A bad switch or router (which almost certainly includes a ton of crappy home APs and routers, compromised by the same actors who ship these devices) could let clients see VLAN tags and ignore them. And an Ethernet “hub” does no filtering at all.
simojo 3mo ago
We purchased a Chinese-made projector from Amazon, which was surprisingly inexpensive (~40 USD). Upon connecting it to the internet, it placed a constantly running feed of ads on the corner of the screen, even while movies were playing. There was no way to disable it either. Even though it's not a stick, it's a similar principle.
- Pxtl 3mo ago
  I mean, did you have to connect it to the internet though? Did it not just have a dp/hdmi port?
- mikestew 3mo ago
  Upon connecting it to the internet… I hesitate to blame the victim here, but why on earth would you do that? “$40 Chinese-made” didn’t give you pause?
  - bigmattystyles 3mo ago
    To be fair, everything is Chinese made. I would be even the Apple TV and NVIDIA Shield are made in China and if a state actor is determined to get a malicious payload in....
    - miladyincontrol 3mo ago
      To play devil's advocate, when someone says "Chinese made" they're usually well aware of your point, and are more using it as a common way to describe product mills spitting out countless devices with dubious quality or configuration. Of course theres good products made in China, and plenty of entirely Chinese brands killing it doing their thing.
      - 8note 3mo ago
        its pretty straight racism though. its US software companies that are the worst of the worst in terms of adware and malware being shipped under monopoly control
hn_submit 3mo ago
I already suggested the U.S. government ban all Chinese products which have a computer in them that's connected to the internet. Instead they're banning stuff willy nilly left and right without really solving the problem. But there's good stuff coming out of China as well. I recently bought a cheap e-reader which has no WiFi or internet connection and it works stellar. And I bought some cheap Chinese sport cams which also lack internet and work great.
- autoexec 3mo ago
  > I already suggested the U.S. government ban all Chinese products which have a computer in them that's connected to the internet. Personally, I think every other country should ban any product made by Google, Amazon, and Microsoft since they all spy on the users of their products too.
  - hn_submit 3mo ago
    I've suggested legislation which would ban the sale of customer information to third-parties. These companies could use the info they gather on customers for their own use but they cannot (re)sell it to anyone, not even the government. The reason being that the information eventually ends up abroad after which you lose all control over it.
stuaxo 3mo ago
How hard is it to get something else on these ? Looks like cheap small computer with a remote control.
deleted 3mo ago
[deleted]
ta988 3mo ago
A familly member had one of those (he had to pay a yearly subscription in addition to the stick). Network would be unusable as soon as it was on for anyone else, and it also tried to scan things on the local network. It was indeed connecting to all kind of services all over the world (and saturating some tables in the router doing so which blocked other clients). Definitely evil, definitely on purpose.
- deepfriedbits 3mo ago
  Reading this, I caught myself wondering how we distill what's in this excellent write up into something the average consumer understands, including the dangers from buying and using devices like this. Is it a graphic that's shared? Something else? I am sure we all know or have heard of people with these devices that promise free streaming.
  - ta988 3mo ago
    I warned them about the risk of those things and showed them what I found, they continued buying the next generation (that person and his two >40yo kids). They NEEDED to watch those soccer games more than they cared about security...
  - Arainach 3mo ago
    The bigger problem is convincing them to care. Botnets are abstract - where's the pain to them? Ad farms? That's "just hurting big corporations". Remember, a significant portion of the population got angry (often violently so) when just asked to wear a mask to protect their neighbors. And the threat there was significantly easier to explain.
    - pibaker 3mo ago
      Just tell the anti mask types the TV sticks come with CCP hacking software preinstalled.
  - ValdikSS 3mo ago
    In the world of auto-updates of software and firmware, even the hardware which is now completely legal and crap-free, could convert itself to a proxy or ad network later any time. And don't forget about counterfeit products (which look like original but different in firmware) and supply chain attack vectors, which are really, really common. If you want to buy something as simple as a feature phone, going to a store with 10 of them will give you at least 1/10 chance to buy a phone with a trojan/backdoor.
mring33621 3mo ago
Using low code tools to build click fraud logic FTW!
rawgabbit 3mo ago
What happens when you stick this malware into your windows PC? The PC is now an accomplice to fraud?
SoftTalker 3mo ago
> Despite repeated warnings from the FBI and security industry leaders about the security and privacy risks of using these streaming devices, major e-commerce providers like Amazon, Best Buy, Newegg and others continue to sell hundreds of different models and brands I scanned the comments and I didn't see anyone suggesting that these companies should share any responsibility for selling these harmful products. Why is it that they seem to get a pass? Would we feel the same about giant retailers selling tainted food, or unsafe children's toys?
- eightysixfour 3mo ago
  Probably because we have little to no way to punish those companies. We can't even stop DJI from shipping their drones under other brands to get around the ban.
  - dessimus 3mo ago
    Our government chooses to not punish those companies. Unfortunately, the lawmakers have decided that the donations to their PACs are more important than actually doing something about it.
- lotsofpulp 3mo ago
  Probably because most people don’t equate the damages from causing bodily harm to whatever these ad clicking networks do. Voters don’t like seeing themselves or their kids get hurt, but they do like lower cost live sports.
- al_borland 3mo ago
  One of the main value propositions for retailers in a world of endless cheap garbage being sold online, is to vet products so customers can trust that what their buying is from a legitimate company and not junk or stuff like these streaming sticks. This is the problem with being an “everything store”. “Everything” includes a lot of things most consumers would like to be protected from, and assume they are due to the long history of retailers standing behind the products they sell. That history seems to have come to an end. They only stand behind it enough to offer a refund if there is a problem, not to ensure it’s good before selling it.
phendrenad2 3mo ago
On the other hand, these are great little devices to root and put Linux on.
buellerbueller 3mo ago
To those who are OK with these devices: when you engage in corruption, do you have any moral standing against your politicians when they engage in corruption? Both you, and the corrupt politicians, are eating away at the trust that underpins society. Certainly, you can argue, your bite is just a tiny one; the politician is eating the whole apple. At the end of the day, everyone suffers from the decline of trust and casual acceptance of fraud.
PufPufPuf 3mo ago
My "streaming device" of choice, ThinkCentre Tiny with Linux, always feels validated with news like these. It fits behind a TV, you can get it second hand for around $40 and depending on model it can even act as a retro game console as well.
- CrimsonCape 3mo ago
  Is there a good TV UI OS that runs desktop youtube under the hood for ad blocking?
  - jojobas 3mo ago
    There is Kodi Youtube plugin that takes a developer token and is then ad-free.
  - PufPufPuf 3mo ago
    I use the VacuumTube app (https://flathub.org/en/apps/rocks.shy.VacuumTube https://flathub.org/en/apps/rocks.shy.VacuumTube), which has ad block, sponsor block, and some more advanced settings! You can use GNOME with scaled up UI or KDE Bigscreen (recently resurrected) for the DE.
burgreblast 3mo ago
Google clutches pearls and is shocked! Shocked! That anyone would violate its policies (while it pockets 30% of the fraudulent revenue). Shocked! And they would have caught them but those crafty criminals spoofed the user-agent. So how _could_ they know?
scottydelta 3mo ago
After getting tired of ads on my PAID smart TV, 6 months ago I started building a casting device using raspberry pi for myself. A couple of months later one of my friends who is an AV technician ended up using it at the largest convention venue in Barcelona to play content on loop, here's a video of that: https://www.youtube.com/shorts/FF3I9EOs4AA https://www.youtube.com/shorts/FF3I9EOs4AA. Fast forward to last month, now I have started selling these in Barcelona, Spain where I am based out of and branched it into three use cases: digital signage, casting, and a portable computer for presentations at events. Here is the link with features: https://soljacast.com https://soljacast.com
- emacdona 3mo ago
  Clicked on the link, ready to buy one. “Contact sales”. Ew. No thanks.
  - scottydelta 3mo ago
    We are literally new and only available in Barcelona at the moment which I mentioned in my comment as well. Not sure what's eww about that?
    - emacdona 3mo ago
      Sorry, knee jerk reaction any time I see “contact sales” instead of a price.
      - scottydelta 3mo ago
        No worries. If you message me via the contact form or chat support on the website, I will try my best to provide you with one. The more feedback I can get, the better. Thanks for liking my product enough to want to buy it right away :)
        cryptoegorophy 3mo ago
        Sales friction is how you lose sales. Make your website one click purchase product page. One button - apply pay, customer pays with preset shipping and then you handle everything from there.
Doohickey-d 3mo ago
Krebs' blog is nice, but quite often it's just re-reporting stuff from somewhere else: Original with more details: https://www.bitsight.com/blog/fuyao-enterprise-building-ad-fraud-empire-ai-and-kids-coding-blocks https://www.bitsight.com/blog/fuyao-enterprise-building-ad-f...
crote 3mo ago
LG televisions and monitors spy on their users and install unwanted software. Half of all smart tvs are running "residential proxy" malware. Google is banning sideloading but happily hosting apps using the Bright SDK. Sorry, but "your tv stick does ad fraud" is just about the most innocent thing I've seen in a while. Everyone in this market is doing the shadiest shit you can imagine. There are no good brands left, you just get to pick what logo your Malware Entertainment Device has.
- inigyou 3mo ago
  Is it even really malware if it's harming advertising networks and not you?
cwillu 3mo ago
“as part of a sprawling operation that seeks to defraud online merchants and advertising networks.” Oh no! Not the advertising networks!
atum47 3mo ago
Got myself a mi box with a custom launcher. Way better than any other Smart TV out there. Unless there's a smart tv that does not show ads right on the fing front page. Anyway, the box is powerful enough to do several things. You can install a IP tv if you want. If you don't, you still have a pretty good media center (you can hook up an external hd on it)
- Scoundreller 3mo ago
  Though I do then wonder about some of the iptv apps even the ones provided through paid subscriptions but that’s already on the dark side; but not as dark as these “buy once” 1000s of pirated channels devices
- aucisson_masque 3mo ago
  The Xiaomi box also send lots of data to Xiaomi server but also ads/tracking network. I switched to a Google box, this has no bloatware and this way I get tracked only by one company.
  - atum47 3mo ago
    It is actually a Google box, at least the software is (don't know if it's modified by Xiaomi). The custom launcher gets rid of those shitty recommend videos on YouTube / Prime / Netflix...
shmuli9 3mo ago
This is amazing. Kudos to the team behind it I mean, sucks for advertisers and is utterly deceitful… but genius!
tomaskafka 3mo ago
At this point China probably has a botnet that can be turned on with a few deploys, and spans a majority of homes in US and RU (and thus is unblockable without disconnecting half of voters from the internet). Ready to attack the infrastructure.
- bashtoni 3mo ago
  I don't know where you get the idea this is a nation state attack. The devices are used to sell proxy services and scam advertisers. This doesn't even need particularly large organised crime. It would certainly be easier than large scale illicit drug importation and retail, which is happening all the time. Could China exploit these streaming sticks if it wanted to? Maybe, but no more than any other nation.
  - tossingafterxyz 3mo ago
    Not necessarily correlated to this, but my perception is that china is generally ok with many types of crime as long as it’s not perpetrated on its citizens / aimed at foreigners (IP theft / counterfeit goods / cyber crime etc). However, I also think the state largely has a good sense of the actor or players and is perfectly capable of exerting force or coercing them to their cause at will.
munk-a 3mo ago
Read this: Use a computer - you actually control the content that way.
zeroq 3mo ago
tangent thought experiment So you bought that top of the line security-as-a-product thingy you can stick in your rack and it will make sure that your network is impenetrable? You know, like those CISCO bricks everyone major company is buying. So have you took an extra precautions to make sure that the firmware on the device is pristine? Do you know anyone who ever touched these devices who actually did? Do you see the problem?
- jojobas 3mo ago
  Cisco bricks leave the factory as pristine as they can be. An intercept sort of attack is possible, but involve quite some effort and risk. These sticks leave the factory with malware pre-flashed, the postman brings them to your door with zero risk for the beneficiary.
deleted 3mo ago
[deleted]
shevy-java 3mo ago
> they secretly rent the user’s Internet connection out to strangers So the mafia is back.
jms703 3mo ago
You buy garbage, you get garbage. You can no longer depend on resellers or to protect you. They are unphased and unaffected by selling you this garbage. No one else has a financial incentive to protect you. Sorry if this sounds victim blamey. Don't mean it to be. Just trying to convey that we're on our own.
byterivet 3mo ago
Good job.
dxxvi 3mo ago
Ah, got it. Those devices are like computer virus which don't need a computer to live on.They can make DDOS attacks if they want to. So, buying these devices at a cheap price is like renting out your IP address and your Internet connection.
BigTTYGothGF 3mo ago
> these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of a sprawling operation that seeks to defraud online merchants and advertising networks. Every cloud has a silver lining.
ColdStream 3mo ago
Alternatively, if you are going to do some questionable things, just buy loads of these things and create a hundred back doors on the network to increase the noise. Sounds good in theory but in practice, computers are good at sorting this stuff out. Kind of why they are so popular.
estebarb 3mo ago
Oh wow, even scammers care about usability and their employees' well-being. What's the excuse for bad UX in internal company software?
perpetuallunch 3mo ago
> rent the user’s Internet connection out to strangers. Harm to the user: none^ > spoof themselves as mobile phones clicking ads on AI-generated websites as part of a sprawling operation that seeks to defraud online merchants and advertising networks Harm to the user: none^ Cost to the dodgy service provides: none Government action to prevent continued dodgy services: none^ This is why internet securityg doomers have a hard time selling their story. Changing behaviour has an upfront, immediate, cost. Not changing it doesn't. ^close enough
- charonn0 3mo ago
  >> rent the user’s Internet connection out to strangers. > Harm to the user: none^ Well, they are losing some of their bandwidth. They might not notice, but something which is rightfully theirs is being taken without consent.
  - perpetuallunch 3mo ago
    If they don't notice, and they're on an unlimited data plan, or the usage is such that it doesn't result in exceeding their data cap, what argument is there that harm occurred?
    - charonn0 3mo ago
      I'm talking about bandwidth; connection speed. The streaming stick in the article turns off its proxying feature while the user is actually streaming because the proxying feature consumes enough bandwidth to degrade streaming quality. In other words, whenever the proxying feature is active every other device sharing the connection will suffer degraded performance. Even if the user never notices, they're still worse off. They're still paying for bandwidth that someone else is using for profit. Money is flowing out of the user's pocket and into the pocket of the proxy operator. That makes the proxy operator a thief who is stealing from the user, and without even the Robin Hood-esque cover of defrauding ad networks.
thothless 3mo ago
roku is sniffing your farts. and reading your texts/emails. https://docs.roku.com/published/userprivacypolicy https://docs.roku.com/published/userprivacypolicy see: "olfactory", "content of" or at least they're CYA while they're sniffing. they definitely scan the entire local network.
theendisney 3mo ago
Long ago I ponder giving away free computers but an ethical formula is really hard. It seemed profit starts to scale exponentialy just beyond the line. (Acepable would be something like 1TB worth of gamedemos)
miohtama 3mo ago
This is why Google/Meta is pushing for "age verification". 1. They want more as targeting data on you 2. They want to reduce bot clicks It's an unholy alliance with governments who want to know who writes what online.
- inigyou 3mo ago
  I'll take residential proxies over mass surveillance any day. It seems surveillance will always expand unless countered.
neves 3mo ago
I really don't mind anymore. My Roku stick is now owned by extreme right Fox Corporation. Chinese ad click network are petty villain compared.
wao0uuno 3mo ago
If you have a Raspberry Pi 5 gathering dust somewhere and need a new streaming box then try LibreELEC. It decodes 4k content just fine. It has HDMI CEC. It can stream from local server or play directly from attached storage. There are no ads or tracking/profiling. It can play YouTube without ads but there is no support for Netflix, Apple TV or similar streaming services.
- dspillett 3mo ago
  A Pi4 does the job well too. They can be had noticeably cheaper than Pi5s ATM, if you don't have the luck of having a device lying around ready to be repurposed, and even the 1Gb models are plenty sufficient. A Pi3 may suffice even, that is what I ran Kodi on before upgrading it to the Pi4, though the lack of hardware x265 decoding support is a limiting factor there (IIRC it'll manage 1080p in software, but only if you have some good cooling installed otherwise things get very skippy after a short while as thermal throttles kick in).
  - wao0uuno 3mo ago
    I’m pretty sure Pi 4 struggles with 4k decoding. It can work but is less than ideal. I also wouldn’t recommend buying a new Pi these days. Prices are insane.
    - dspillett 3mo ago
      Most of what I watch is 1080p (I don't really have 4K capable eyes!) but it definitely plays 4K 265 well. Only 265 though, the hardware support for 264 is limited to 1080 so 4K there means software decoding which I imagine being a problem much like 265 on the Pi3. It is pretty rare to see 264 used for 4K content though, in my experience.
joeisnotjane 3mo ago
Ah, it's about "China, China.." Preparing casus belli.. first, open weights LLM which are "not secure", now "TV sticks".. Oh joes and janes, who will put finally some sense into you..
- Ikatza 3mo ago
  Ah, yes, the great TV sticks war of 2028. We'll tell the stories.
  - joeisnotjane 3mo ago
    It is about gradually, but constantly, creating the image of an "evil adversary".. Venome drop after venome drop.. China is not doing that as far as I know. Neither Russia did it before the war, though you were claiming the contrary (I know, since I live in the west and could compare news from both sides, being a native Russian speaker).
inigyou 3mo ago
Krebs fails to make any case for why someone wanting to watch movies and TV should give a shit. I get that these products are personally inconvenient to Brian Krebs and his work, and to companies that make money blocking people from accessing the internet, and to companies that make money spewing ads in people's faces. So? Why should anyone care about any of those? In fact I think some people would get one of these sticks just to inconvenience the latter two groups!
AlexandrB 3mo ago
This is only slightly more malicious than the software "Smart TVs" already ship with.
stevetron 3mo ago
Birds Nest soup with Chinese tomatoes? Or Cinese noodles with Chinese tomatoes? It sounds likw 2 domestic markets that China should use to rid themseves of their over-abundance of tomatoes.
SnipeOfficial 3mo ago
[flagged]
coretx 3mo ago
The most relevant difference between using a TV and a "TV streaming stick" is corpos & the State controling the malware/surveillance device. Being a ordinary person, I do not want criminals or the ( ads/data ) industry or the state to be in control of my property. Also, any DRM not passed by a parliament undermines the rule of law & statehood. This is something Krebs and his Praetorian guard buddies must know.

818 points by speckx 3mo ago

[dead]

In this case it’s actual malice, that the streaming stick is set up for residential proxy and ad fraud straight from the factory. But incompetence can lead to the same place if it’s a poorly engineered, un-maintained device with an old version of Android that will never be patched and is always one no-click exploit away from being commandeered into residential proxy and ad fraud.

alex_duf 3mo ago
I wonder to what degree malice can be engineered to look like incompetence?
- abbeyj 3mo ago
  Try examining the old entries from the https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest.
FinnKuhn 3mo ago
Those TV streaming boxes really are (from a cybersecurity perspective) probably one of the worst things you can buy. Here is the "Darknet Diaries" Episode on them: https://darknetdiaries.com/episode/172/ https://darknetdiaries.com/episode/172/
- labbett 3mo ago
  Superbox 3 is coming up at DEF CON next Friday! https://hackertracker.app/defcon34/content/67257 https://hackertracker.app/defcon34/content/67257
  - doctorspazz 3mo ago
    Thank you for sharing this. The superbox investigations have been incredibly interesting to follow.
frollogaston 3mo ago
Since these are poorly engineered, wonder how easy it'd be to reverse-engineer one and just get the free streaming on a non-scam device.
- dpoloncsak 3mo ago
  If it's something like a Firestick (or the knock-off featured in the article), you're really just connecting to Content Provider servers to handle auth and content streaming, right? They're just OSes designed to run Netflix and Hulu. Would be hard to spoof I think
  - mikepurvis 3mo ago
    Indeed. Owning the streaming box lets you loose on whatever network it's on, but it doesn't actually get you inside the content gardens; those are separately managed by teams of people much more motivated to protect their IP.
- kiririn 3mo ago
  See CoreELEC/LibreELEC/etc - totally replaces the (potentially dodgy) Android OS on these kind of streaming boxes with a stripped down Linux+Kodi setup
  - qmr 3mo ago
    I thought those were for x86? They run on ARM TV boxes / sticks now?
    - tesnorindian 3mo ago
      LibreElec also supports ARM builds than can run on SBC like Raspberry Pi. While CoreElec is exclusively for Amlogic ARM processors.
- wildzzz 3mo ago
  Best case, you can grab the credentials off the Kodi box and use them on a clean install. Worst case, everything is packaged up in a single app so it's all or nothing. Although you could just wipe the box and find another pirate TV provider.
acdha 3mo ago
I was trying to figure out why we saw so many fraudulent applications from Vietnam for a service which is restricted to the United States, especially because they were all getting rejected - it seemed like even the laziest spammer would lose interest in something they couldn’t monetize. A guy in Vietnam mentioned that one of the largest ISPs there used these really dodgy Chinese modems which were so notoriously insecure that it was apparently common knowledge that you should replace them if performance was slow because that was a sign that yours was being used by a botnet. Apparently the cost of access to one of those nodes was so low that the spammers don’t even really monitor their bots.
8note 3mo ago
consumers are however happy to buy a cheaper stick with an overall public bad
- inigyou 3mo ago
  I don't even think it's a public bad. I think attacking internet gatekeepers like Cloudflare is objectively a public good. So is attacking legal spam companies.
  - psd1 3mo ago
    ...ish. Attacking their monopoly, great. Attacking their workers by bombing an office, not so great. Throwing ever more spam traffic across the tubes isn't a attack, it's marketing on their behalf.
    - inigyou 3mo ago
      In what way is clicking an ad like bombing an office?
      - psd1 3mo ago
        I think i was clear, but I'll try again. You said this: > attacking internet gatekeepers I think we agree that you don't mean all kinds of attack. The agreed exception is bombs. I put it to you that throwing bot traffic around is another kind of attack that you do not want, because it drives product sales. You would be doing them a favour.
inigyou 3mo ago
What is the malice in those things?

glitchc 3mo ago

Defrauding ad networks doesn't seem like a bad thing, although using my internet connection as a proxy is obviously terrible. It wouldn't surprise me to learn that my connection is being sold as a VPN service by the vendor.

alistairSH 3mo ago
It'll be a marginal effect, but fake clicks impacts the ad buyer, which then impacts their financials and pricing. The only winner here is the scammers running the fake affiliate sites on which these sticks are "clicking". Or, am I missing some facet of this enterprise?
- ssl-3 3mo ago
  Another winner is the person who gets to watch cheap digital TV, without putting together a usable antenna and limiting their reception to the broadcast channels that are nearby. I mean: They just pay the money, plug the thing in, push some buttons, and: TV happens. Right?
  - snickerbockers 3mo ago
    Theres the question of whether or not the fraudulent advertisement clicking is using enough traffic to inconvenience or impose fees upon the user but otherwise I agree with you and am tempted to buy one just to fuck with advertisers. Backdoors and spying are also a problem in theory except at this point you can't even trust "legitimate" companies on that front so it's a moot point.
    - acdha 3mo ago
      > otherwise I agree with you and am tempted to buy one just to fuck with advertisers. How that actually works in practice is that your favorite sites make less money and your IP gets a bad reputation so you CAPTCHAs or outright blocked. There’s no “sticking it to the man” here, just contributing to the frictional grind making the internet worse for ordinary people.

skinfaxi 3mo ago

Thankfully this seems limited to a specific device (H96). Darknet diaries has a good story about streaming devices https://www.youtube.com/watch?v=dS6PkuZuxJ4 https://www.youtube.com/watch?v=dS6PkuZuxJ4

krebsonsecurity 3mo ago
It's not just one device line; Have a look at the list maintained by the proxy tracking service Synthient, which tracks streaming boxes, digital picture frames and other IoT devices that have been known to bundle residential proxy software, among other malicious apps. They currently track almost 1,000 different makes and model numbers. https://github.com/synthient/public-research/blob/main/2026/01/kimwolf/product_names.csv https://github.com/synthient/public-research/blob/main/2026/...

pavel_lishin 3mo ago

> generic TV boxes that promise unlimited content streaming for a one-time fee I don't want to blame the purchasers of these things - who are some of the victims - but at the same time, it does seem like a Too Good To Be True situation.

croes 3mo ago
It sounds like scam
havaloc 3mo ago
I have an elderly client who sends me links of stuff to buy all the time. One day it's one of these streaming sticks, the next day it's half-price stamps, and I tell her every time, please don't buy this stuff. And yet she does anyway, as if I was almost being mean and saying no just to say no. So yes, I do want to blame the purchasers of these things, sometimes. To prove her point that her stamps were legitimate, she mailed me a card using one of her half priced (but likely fake) stamps and it made it through!
- Terr_ 3mo ago
  Perhaps they grew up in a time/environment where "if it was that bad they wouldn't be allowed to advertise it", and they're still using that old calibration?
  - mhurron 3mo ago
    My falther-in-law was less that and more, if I can get away with it, it's actually legal. Many know their fake, and do it because they can get away with it. That was his justification for a satellite descrambler, they're sending me the signals, obviously I'm allowed to.
    - mmooss 3mo ago
      I can imagine many on HN having excited discussions about their satellite descramblers. > do it because they can get away with it. Lots of people on HN download and upload copyrighted materials. Is it really different?

giraffe_lady 3mo ago

> allowing low-skilled operators to drag blocks of code together in their editor — without any need to understand what the underlying code blocks do or how they work. We're called engineers brian.

cryo32 3mo ago

A better solution is just leech the content and stick it on a generic USB flash stick.

harvey9 3mo ago
These are popular for illegal live sports streams.
- cryo32 3mo ago
  I just go down the pub.

j45 3mo ago

Generally, it's advisable to create a dedicated wifi network for all potentially hostile devices. This dedicated wifi network can just be connecting your devices to your guest wifi while you figure it out, and limiting the rate of speed as needed. That can be cameras, tv's, thermostats, tv sticks and anything else that might not only call home, but actively scope what you have in your home network when it's none of it's business.

spelk 3mo ago
I don't think this would make a big difference for the threat model described in the OP? They'd still be able to use your IP Address and potentially do nefarious things through your role as an unwitting proxy.
- j45 3mo ago
  Using one device as a proxy is a few steps away from trying to exploit and infiltrate the other devices on your machine as well. An unwitting proxy is already crossing the line to putting a fox in the henhouse. Limiting what outbound access devices can/can't have is an important skill to learn.
drnick1 3mo ago
> That can be cameras, tv's, thermostats, tv sticks and anything else that might not only call home That is not enough. You need to air gap devices that have legitimately no business communicating with anyone or anything outside the house. TVs, thermostats, and other Internet-of-Crap gadgets do not need "firmware updates." Either they work out of the box, offline or within the LAN, or they get sent back for a refund wherever they came from.
- j45 3mo ago
  Agreed. That usually comes as a step after getting these items on a separate SSID.

giantg2 3mo ago

So where can I get an actual privacy focused streaming box, even if the apps (Neflix etc) running on it are not?

cogman10 3mo ago
I'm increasingly being convinced the only way to do that is you do a media pc nuc. The problem, of course, is you probably won't have the netflix app. It's painful to setup such a box to stream from various services.
- mbmbn 3mo ago
  I tried going that route, but most apps for streaming are Android. And that was only one of the issues. It was a rabbit hole and in the end I got back using my NVIDIA Shield. This is about 10 years now, but it’s actually still the best option.
- Tepix 3mo ago
  What's wrong with Apple TV? It runs VLC if you want to stream something from your NAS.
- giantg2 3mo ago
  I tried to look at setting up an stripped down privacy-focused Android based box for Netflix, but ran into issues. Seems like you need to be spied on to run Netflix.
- dwaltrip 3mo ago
  What about just using the Netflix desktop website? Or does that limit the resolution?
MattTheRealOne 3mo ago
Apple TV is currently the best balance of privacy and convenience. The only way to get more private is using a PC, but that limits the resolution for most streaming services to 720p or 1080p.

m3047 3mo ago

Brazil. Last year I effectively blocked Brazil for a while. Ultimately I settled on three possibilities for the traffic I was seeing: 01: DDOS 10: Residential proxies 11: Somebody DDOSing residential proxies

drdexebtjl 3mo ago
I can’t prove it, but I live in Brazil and after getting a smart TV from LG, I started receiving challenges across all Google services, indicating they received bot traffic from my network. I only used apps from streaming services I actually paid for. I suspect these TVs either come with residential proxies set up from the factory, or they have such poor security that they’re instantly hacked. Either way, TV manufacturers (including reputable ones like LG) are to blame.
- mikestew 3mo ago
  There have been articles lately about the residential proxies loaded in apps for LG TVs. My LG has never seen a network connection, so I’m fuzzy on details.
- inigyou 3mo ago
  LG has been in the news just this week for a whole lot of shady practices, which cast light on their other shady practices. Yes, residential proxying is one of them. I don't think residential proxying is all that shady since groups like Cloudflare have made it a necessity. However, having it out-of-the-box on a name-brand device is extremely shady.

codedokode 3mo ago

I do not see problems with fake ad clicks and have no sympathy for ad companies. Also pre-installed adware is not a surprise, I found adware in the official firmware image of a certain Chinese tablet. What worries me much more is backdoors from the foreign companies and governments that can be pre-installed at the factory to collect intelligence information. For example, I became aware that a certain maker of a popular mobile OS was collecting the cell tower IDs and WiFi access point identifiers along with GPS coordinates of a device. Obviously they collect this information to be able to guide missiles and drones when GPS signal is jammed (GPS is very low power and easy to jam). This is not acceptable. How can we prevent this? I think, for every imported device having a CPU and Internet connectivity: - the user must be able to re-flash firmware with their own code. - the local government must have access to the full source code and be able to search for vulnerabilities or backdoors, including using AI tools. Found vulnerabilities are considered a reward and may be used against countries not doing inspections. No access - no import permission. - any telemetry or data collection, or updates must be opt-in only and disabled by default. - any telemetry or updates must go through a server controlled by the local government, in unencrypted form, to detect attempts to collect intelligence information or install malicious update. Sadly our government instead only demands that manufacturers pre-install their closed-source software on all imported devices and that's all.

BoppreH 3mo ago
> a certain maker of a popular mobile OS was collecting the cell tower IDs and WiFi access point identifiers along with GPS coordinates of a device. Obviously they collect this information to be able to guide missiles and drones when GPS signal is jammed Is this sarcasm? GPS can take several minutes to get a location, and works poorly indoors. One of the reasons why Google Maps is so quick and precise is because Google has gathered exactly this data through users and Street View drive-bys. Could it be used for missiles? Sure. Is it obviously the intention? No.
- meatmanek 3mo ago
  Yeah this is extremely standard: Apple: https://support.apple.com/en-us/102515 https://support.apple.com/en-us/102515 > If Location Services is on, your device will periodically send the geo-tagged locations of nearby Wi-Fi hotspots and cell towers to Apple to augment Apple's crowd-sourced database of Wi-Fi hotspot and cell tower locations. Google: https://support.google.com/android/answer/15157297?sjid=16484070620133019469-NC https://support.google.com/android/answer/15157297?sjid=1648... > When Location Accuracy is on, Google periodically collects information about the locations of wireless signals and sensors observed by your device to crowdsource location estimates. This helps everyone find locations better. Mozilla used to run a very similar service: https://en.wikipedia.org/wiki/Mozilla_Location_Service https://en.wikipedia.org/wiki/Mozilla_Location_Service Not to mention truly crowd-sourced databases like wigle.net.

Mistletoe 3mo ago

I recently got an Apple TV 4K and have been really enjoying the ad free experience. Worth every penny. Our smart tv had turned into a Christmas tree of ads.

ocd 3mo ago
As much as I hate Apple for what they've done to the average consumer in regards to computing, it would be just impossible and dishonest to say anything other than Apple is the outright winner in streaming devices. The experience is so smooth.
- ghostly_s 3mo ago
  Considering their recent decision to give up on building Apple Maps into a serious contender and instead enshittify it with ads, I don't have much faith Apple TV will be far behind.
  - dhosek 3mo ago
    One hopes that the new CEO will realize the turn towards ads is ruining the Apple brand and pull back on that front.
    - inigyou 3mo ago
      Ha! No company has ever reversed enshittification.
      - dhosek 3mo ago
        Although Apple did undo the touchbar (although I think they gave up on it too soon—I actually liked it once they restored the esc key. I can never remember what all the F-keys are supposed to do and getting an app-specific set of graphical choices made more sense to me.
- trouve_search 3mo ago
  The nvidia shield is pretty damn good as well, even if old at this point.

AlotOfReading 3mo ago

Of all the evils normally associated with visual programming languages, enabling cybercrime isn't one I've previously considered. Now that I've seen it, I'm surprised it wasn't more common before LLMs appeared.

defmetrix 3mo ago

I didnt know anybody bought a streaming stick anymore

yunnpp 3mo ago

And which part of "ad fraud" is the fraud? As far as I can tell, ad networks and advertisers are the fraud and they are also part of the increasing surveillance state. Didn't know Krebs was a mainstream news puppet.

brainwad 3mo ago
It's called fraud because the ad host colludes with (or directly controls) the botnet to get lots of clicks on ads hosted on their sites, making them money at the expense of advertisers. If you just want to spam clicks on ads you don't financially be edit from, go for it.

yumraj 3mo ago

Any way to identify or block these proxy and ad click services in the router? Say a Ubiquiti or even pfsense? I’m not using any of these boxes for especially this reason, but about 10-15 years ago had noticed my treadmill pinging a Chinese portal. I removed the WiFi access from the treadmill but am curious if there might be other devices. Any specific ports, etc these guys use or are they mostly impossible to distinguish from regular internet traffic? My another worry has been if these can monitor other Internet traffic, though I think HTTPS should mostly prevent that.

utopiah 3mo ago

I bet this is much broader than we all realized because just earlier today I was reading on https://gist.github.com/probonopd/3ad6b7777caea1503f00d5fe7710ad06#adb https://gist.github.com/probonopd/3ad6b7777caea1503f00d5fe77... in order to tinker with a cheap (like really cheap) Android video projector : "Device: Magcubic HY300 Pro Android Projector (ui_Veng.projector) Issue: Device was being used as a residential proxy node without consent, causing thousands of suspicious DNS requests and bandwidth usage." linked in there just few months ago. It's not present on mine (AFAICT) which lead me to think either it was a genuine mistake or their bailed on that benefit or they upgraded to a harder to detect technique. An acquaintance mentioned they also bought a similar device few months ago. I believe there will be a lot MORE of these so we should soon be able to witness if it's an innocent mistake or the new normal.

LetsGetTechnicl 3mo ago
Oh wow that's the same projector I have. Would be really cool to install a custom build on it, but for now I just have an Apple TV connected to it.
- utopiah 3mo ago
  You can already adb connect in dev mode then install .apks, e.g. termux, Fennec and change some settings. It does seem rootable but I didn't try.

stronglikedan 3mo ago

> But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks. You had me at "But"! ::swoon::

RajT88 3mo ago

A pirate TV box from China presents a security threat? This is my surprised face.

inigyou 3mo ago
No actual security threat was stated in TFA though. Only revenue threats.

gxs 3mo ago

No mention of Roku I use one but only when traveling at hotels - it’s one of the only sticks that can connect to captive WiFi networks at hotels I’ve got barely anything on it so privacy be damned - but at this point this is why I just buy apple products I have two apple tv’s which probably do shady things too, but I’m willing to play the probabilities and assume it’s the least bad of my options short of tinkering with flashing hardware and all that stuff that used to be fun in my teens (emphasis on used to)

kazinator 3mo ago

> But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads ... Compromised (or malicious from the factory) devices being recruited into bot farms for click fraud is ... a groundbreaking discovery in 2026? > on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks. To hell with AI-generated websites and advertising networks. Say, where can I get the most effective malicious TV stick for click-frauding the fuck out of that shit? I will take fifteen! :)

snickerbockers 3mo ago
I'm imaging a largescale distributed project like folding@home except instead of doing scientific research everybody is working together to fuck with advertisers, tracking cookies, etc.

cute_boi 3mo ago

The best solution to this problem is to block GeoIP traffic and monitor bandwidth consumption on a per-domain basis. If something is sending data during the night, it becomes much easier to identify suspicious activity.

Hasz 3mo ago

Hey that’s pretty smart! Fradulent, but very smart. I was honestly expecting botnet. I expect many cameras of “dubious” origin are used for similar tasks, same with most “smart” devices with sufficient horsepower.

Pxtl 3mo ago

> major e-commerce providers like Amazon, Best Buy, Newegg and others continue to sell hundreds of different models and brands that bundle unofficial versions of Google’s Android operating system and are frequently marketed (via online influencers) as a way to access a broad array of streaming services and live broadcasts without a subscription. This is why I giggle when people talk about ending Section 230 in the USA (or various international counterparts thereof). The largest companies on Earth are happily selling hacked piracy spyware botnet garbage. Not just hosting malicious posts for free like Section 230 protects, but selling illegal physical devices and taking a cut of the profit and excusing it with a pathetic whack-a-mole moderation system. It's already illegal and the law has already failed. Sean Parker's mistake was that he wasn't rich enough. Laws are for poor people.

a-dub 3mo ago

it's just like a phone. don't buy a crappy one with firmware of unknown provenance. make sure the one you do buy has an active and effective effort that you trust that ships timely security fixes.

matheusmoreira 3mo ago

That reminds me, I need to configure VLANs in my router so that all my trusted computers are isolated from all the other garbage that makes it into the network.

ur-whale 3mo ago
Mmmh, I've always wondered ... as much as VLAN's are a very useful tools to - for example - route two separate LAN's traffic through a shared physical link ... are they any good when it come to security? I mean, I don't believe VLAN's were designed with security as a goal, and I wonder how "strong" the virtual wall between two VLAN's actually is? Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel? Just wondering.
- ahahs 3mo ago
  this is a good question, i asked claude sonnet 5 and the answer is too big and complex for me to type out on mobile. but long story short, you absolutely need separate VLANs and Firewalls in conjuction to secure traffic between networks
  - matheusmoreira 3mo ago
    Yeah, I've been using Claude to help me secure my home network. I applied to Anthropic's cyber program and got accepted despite being a hobbyist. I'm not very good at networks so I'm gonna try to make the most of it. Really wish I could point Mythos at my router and just loop it until my router becomes literally unhackable.
    - TylerE 3mo ago
      Making your router unhackable is trivial. Just pull the AC cord. You didn't specify that it had to be useable.
- rcoder 3mo ago
  Depends on your networking setup. A good switch will simply refuse to route packets between clients on different VLANs, and hide the existence of the tags that determine which VLAN a host is on. A bad switch or router (which almost certainly includes a ton of crappy home APs and routers, compromised by the same actors who ship these devices) could let clients see VLAN tags and ignore them. And an Ethernet “hub” does no filtering at all.

simojo 3mo ago

We purchased a Chinese-made projector from Amazon, which was surprisingly inexpensive (~40 USD). Upon connecting it to the internet, it placed a constantly running feed of ads on the corner of the screen, even while movies were playing. There was no way to disable it either. Even though it's not a stick, it's a similar principle.

Pxtl 3mo ago
I mean, did you have to connect it to the internet though? Did it not just have a dp/hdmi port?
mikestew 3mo ago
Upon connecting it to the internet… I hesitate to blame the victim here, but why on earth would you do that? “$40 Chinese-made” didn’t give you pause?
- bigmattystyles 3mo ago
  To be fair, everything is Chinese made. I would be even the Apple TV and NVIDIA Shield are made in China and if a state actor is determined to get a malicious payload in....
  - miladyincontrol 3mo ago
    To play devil's advocate, when someone says "Chinese made" they're usually well aware of your point, and are more using it as a common way to describe product mills spitting out countless devices with dubious quality or configuration. Of course theres good products made in China, and plenty of entirely Chinese brands killing it doing their thing.
    - 8note 3mo ago
      its pretty straight racism though. its US software companies that are the worst of the worst in terms of adware and malware being shipped under monopoly control

hn_submit 3mo ago

I already suggested the U.S. government ban all Chinese products which have a computer in them that's connected to the internet. Instead they're banning stuff willy nilly left and right without really solving the problem. But there's good stuff coming out of China as well. I recently bought a cheap e-reader which has no WiFi or internet connection and it works stellar. And I bought some cheap Chinese sport cams which also lack internet and work great.

autoexec 3mo ago
> I already suggested the U.S. government ban all Chinese products which have a computer in them that's connected to the internet. Personally, I think every other country should ban any product made by Google, Amazon, and Microsoft since they all spy on the users of their products too.
- hn_submit 3mo ago
  I've suggested legislation which would ban the sale of customer information to third-parties. These companies could use the info they gather on customers for their own use but they cannot (re)sell it to anyone, not even the government. The reason being that the information eventually ends up abroad after which you lose all control over it.

stuaxo 3mo ago

How hard is it to get something else on these ? Looks like cheap small computer with a remote control.

deleted 3mo ago

[deleted]

ta988 3mo ago

A familly member had one of those (he had to pay a yearly subscription in addition to the stick). Network would be unusable as soon as it was on for anyone else, and it also tried to scan things on the local network. It was indeed connecting to all kind of services all over the world (and saturating some tables in the router doing so which blocked other clients). Definitely evil, definitely on purpose.

deepfriedbits 3mo ago
Reading this, I caught myself wondering how we distill what's in this excellent write up into something the average consumer understands, including the dangers from buying and using devices like this. Is it a graphic that's shared? Something else? I am sure we all know or have heard of people with these devices that promise free streaming.
- ta988 3mo ago
  I warned them about the risk of those things and showed them what I found, they continued buying the next generation (that person and his two >40yo kids). They NEEDED to watch those soccer games more than they cared about security...
- Arainach 3mo ago
  The bigger problem is convincing them to care. Botnets are abstract - where's the pain to them? Ad farms? That's "just hurting big corporations". Remember, a significant portion of the population got angry (often violently so) when just asked to wear a mask to protect their neighbors. And the threat there was significantly easier to explain.
  - pibaker 3mo ago
    Just tell the anti mask types the TV sticks come with CCP hacking software preinstalled.
- ValdikSS 3mo ago
  In the world of auto-updates of software and firmware, even the hardware which is now completely legal and crap-free, could convert itself to a proxy or ad network later any time. And don't forget about counterfeit products (which look like original but different in firmware) and supply chain attack vectors, which are really, really common. If you want to buy something as simple as a feature phone, going to a store with 10 of them will give you at least 1/10 chance to buy a phone with a trojan/backdoor.

mring33621 3mo ago

Using low code tools to build click fraud logic FTW!

rawgabbit 3mo ago

What happens when you stick this malware into your windows PC? The PC is now an accomplice to fraud?

SoftTalker 3mo ago

> Despite repeated warnings from the FBI and security industry leaders about the security and privacy risks of using these streaming devices, major e-commerce providers like Amazon, Best Buy, Newegg and others continue to sell hundreds of different models and brands I scanned the comments and I didn't see anyone suggesting that these companies should share any responsibility for selling these harmful products. Why is it that they seem to get a pass? Would we feel the same about giant retailers selling tainted food, or unsafe children's toys?

eightysixfour 3mo ago
Probably because we have little to no way to punish those companies. We can't even stop DJI from shipping their drones under other brands to get around the ban.
- dessimus 3mo ago
  Our government chooses to not punish those companies. Unfortunately, the lawmakers have decided that the donations to their PACs are more important than actually doing something about it.
lotsofpulp 3mo ago
Probably because most people don’t equate the damages from causing bodily harm to whatever these ad clicking networks do. Voters don’t like seeing themselves or their kids get hurt, but they do like lower cost live sports.
al_borland 3mo ago
One of the main value propositions for retailers in a world of endless cheap garbage being sold online, is to vet products so customers can trust that what their buying is from a legitimate company and not junk or stuff like these streaming sticks. This is the problem with being an “everything store”. “Everything” includes a lot of things most consumers would like to be protected from, and assume they are due to the long history of retailers standing behind the products they sell. That history seems to have come to an end. They only stand behind it enough to offer a refund if there is a problem, not to ensure it’s good before selling it.

phendrenad2 3mo ago

On the other hand, these are great little devices to root and put Linux on.

buellerbueller 3mo ago

To those who are OK with these devices: when you engage in corruption, do you have any moral standing against your politicians when they engage in corruption? Both you, and the corrupt politicians, are eating away at the trust that underpins society. Certainly, you can argue, your bite is just a tiny one; the politician is eating the whole apple. At the end of the day, everyone suffers from the decline of trust and casual acceptance of fraud.

PufPufPuf 3mo ago

My "streaming device" of choice, ThinkCentre Tiny with Linux, always feels validated with news like these. It fits behind a TV, you can get it second hand for around $40 and depending on model it can even act as a retro game console as well.

CrimsonCape 3mo ago
Is there a good TV UI OS that runs desktop youtube under the hood for ad blocking?
- jojobas 3mo ago
  There is Kodi Youtube plugin that takes a developer token and is then ad-free.
- PufPufPuf 3mo ago
  I use the VacuumTube app (https://flathub.org/en/apps/rocks.shy.VacuumTube https://flathub.org/en/apps/rocks.shy.VacuumTube), which has ad block, sponsor block, and some more advanced settings! You can use GNOME with scaled up UI or KDE Bigscreen (recently resurrected) for the DE.

burgreblast 3mo ago

Google clutches pearls and is shocked! Shocked! That anyone would violate its policies (while it pockets 30% of the fraudulent revenue). Shocked! And they would have caught them but those crafty criminals spoofed the user-agent. So how _could_ they know?

scottydelta 3mo ago

After getting tired of ads on my PAID smart TV, 6 months ago I started building a casting device using raspberry pi for myself. A couple of months later one of my friends who is an AV technician ended up using it at the largest convention venue in Barcelona to play content on loop, here's a video of that: https://www.youtube.com/shorts/FF3I9EOs4AA https://www.youtube.com/shorts/FF3I9EOs4AA. Fast forward to last month, now I have started selling these in Barcelona, Spain where I am based out of and branched it into three use cases: digital signage, casting, and a portable computer for presentations at events. Here is the link with features: https://soljacast.com https://soljacast.com

emacdona 3mo ago
Clicked on the link, ready to buy one. “Contact sales”. Ew. No thanks.
- scottydelta 3mo ago
  We are literally new and only available in Barcelona at the moment which I mentioned in my comment as well. Not sure what's eww about that?
  - emacdona 3mo ago
    Sorry, knee jerk reaction any time I see “contact sales” instead of a price.
    - scottydelta 3mo ago
      No worries. If you message me via the contact form or chat support on the website, I will try my best to provide you with one. The more feedback I can get, the better. Thanks for liking my product enough to want to buy it right away :)
      - cryptoegorophy 3mo ago
        Sales friction is how you lose sales. Make your website one click purchase product page. One button - apply pay, customer pays with preset shipping and then you handle everything from there.

Doohickey-d 3mo ago

Krebs' blog is nice, but quite often it's just re-reporting stuff from somewhere else: Original with more details: https://www.bitsight.com/blog/fuyao-enterprise-building-ad-fraud-empire-ai-and-kids-coding-blocks https://www.bitsight.com/blog/fuyao-enterprise-building-ad-f...

crote 3mo ago

LG televisions and monitors spy on their users and install unwanted software. Half of all smart tvs are running "residential proxy" malware. Google is banning sideloading but happily hosting apps using the Bright SDK. Sorry, but "your tv stick does ad fraud" is just about the most innocent thing I've seen in a while. Everyone in this market is doing the shadiest shit you can imagine. There are no good brands left, you just get to pick what logo your Malware Entertainment Device has.

inigyou 3mo ago
Is it even really malware if it's harming advertising networks and not you?

cwillu 3mo ago

“as part of a sprawling operation that seeks to defraud online merchants and advertising networks.” Oh no! Not the advertising networks!

atum47 3mo ago

Got myself a mi box with a custom launcher. Way better than any other Smart TV out there. Unless there's a smart tv that does not show ads right on the fing front page. Anyway, the box is powerful enough to do several things. You can install a IP tv if you want. If you don't, you still have a pretty good media center (you can hook up an external hd on it)

Scoundreller 3mo ago
Though I do then wonder about some of the iptv apps even the ones provided through paid subscriptions but that’s already on the dark side; but not as dark as these “buy once” 1000s of pirated channels devices
aucisson_masque 3mo ago
The Xiaomi box also send lots of data to Xiaomi server but also ads/tracking network. I switched to a Google box, this has no bloatware and this way I get tracked only by one company.
- atum47 3mo ago
  It is actually a Google box, at least the software is (don't know if it's modified by Xiaomi). The custom launcher gets rid of those shitty recommend videos on YouTube / Prime / Netflix...

shmuli9 3mo ago

This is amazing. Kudos to the team behind it I mean, sucks for advertisers and is utterly deceitful… but genius!

tomaskafka 3mo ago

At this point China probably has a botnet that can be turned on with a few deploys, and spans a majority of homes in US and RU (and thus is unblockable without disconnecting half of voters from the internet). Ready to attack the infrastructure.

bashtoni 3mo ago
I don't know where you get the idea this is a nation state attack. The devices are used to sell proxy services and scam advertisers. This doesn't even need particularly large organised crime. It would certainly be easier than large scale illicit drug importation and retail, which is happening all the time. Could China exploit these streaming sticks if it wanted to? Maybe, but no more than any other nation.
- tossingafterxyz 3mo ago
  Not necessarily correlated to this, but my perception is that china is generally ok with many types of crime as long as it’s not perpetrated on its citizens / aimed at foreigners (IP theft / counterfeit goods / cyber crime etc). However, I also think the state largely has a good sense of the actor or players and is perfectly capable of exerting force or coercing them to their cause at will.

munk-a 3mo ago

Read this: Use a computer - you actually control the content that way.

zeroq 3mo ago

tangent thought experiment So you bought that top of the line security-as-a-product thingy you can stick in your rack and it will make sure that your network is impenetrable? You know, like those CISCO bricks everyone major company is buying. So have you took an extra precautions to make sure that the firmware on the device is pristine? Do you know anyone who ever touched these devices who actually did? Do you see the problem?

jojobas 3mo ago
Cisco bricks leave the factory as pristine as they can be. An intercept sort of attack is possible, but involve quite some effort and risk. These sticks leave the factory with malware pre-flashed, the postman brings them to your door with zero risk for the beneficiary.

deleted 3mo ago

[deleted]

shevy-java 3mo ago

> they secretly rent the user’s Internet connection out to strangers So the mafia is back.

jms703 3mo ago

You buy garbage, you get garbage. You can no longer depend on resellers or to protect you. They are unphased and unaffected by selling you this garbage. No one else has a financial incentive to protect you. Sorry if this sounds victim blamey. Don't mean it to be. Just trying to convey that we're on our own.

byterivet 3mo ago

Good job.

dxxvi 3mo ago

Ah, got it. Those devices are like computer virus which don't need a computer to live on.They can make DDOS attacks if they want to. So, buying these devices at a cheap price is like renting out your IP address and your Internet connection.

BigTTYGothGF 3mo ago

> these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of a sprawling operation that seeks to defraud online merchants and advertising networks. Every cloud has a silver lining.

ColdStream 3mo ago

Alternatively, if you are going to do some questionable things, just buy loads of these things and create a hundred back doors on the network to increase the noise. Sounds good in theory but in practice, computers are good at sorting this stuff out. Kind of why they are so popular.

estebarb 3mo ago

Oh wow, even scammers care about usability and their employees' well-being. What's the excuse for bad UX in internal company software?

perpetuallunch 3mo ago

> rent the user’s Internet connection out to strangers. Harm to the user: none^ > spoof themselves as mobile phones clicking ads on AI-generated websites as part of a sprawling operation that seeks to defraud online merchants and advertising networks Harm to the user: none^ Cost to the dodgy service provides: none Government action to prevent continued dodgy services: none^ This is why internet securityg doomers have a hard time selling their story. Changing behaviour has an upfront, immediate, cost. Not changing it doesn't. ^close enough

charonn0 3mo ago
>> rent the user’s Internet connection out to strangers. > Harm to the user: none^ Well, they are losing some of their bandwidth. They might not notice, but something which is rightfully theirs is being taken without consent.
- perpetuallunch 3mo ago
  If they don't notice, and they're on an unlimited data plan, or the usage is such that it doesn't result in exceeding their data cap, what argument is there that harm occurred?
  - charonn0 3mo ago
    I'm talking about bandwidth; connection speed. The streaming stick in the article turns off its proxying feature while the user is actually streaming because the proxying feature consumes enough bandwidth to degrade streaming quality. In other words, whenever the proxying feature is active every other device sharing the connection will suffer degraded performance. Even if the user never notices, they're still worse off. They're still paying for bandwidth that someone else is using for profit. Money is flowing out of the user's pocket and into the pocket of the proxy operator. That makes the proxy operator a thief who is stealing from the user, and without even the Robin Hood-esque cover of defrauding ad networks.

thothless 3mo ago

roku is sniffing your farts. and reading your texts/emails. https://docs.roku.com/published/userprivacypolicy https://docs.roku.com/published/userprivacypolicy see: "olfactory", "content of" or at least they're CYA while they're sniffing. they definitely scan the entire local network.

theendisney 3mo ago

Long ago I ponder giving away free computers but an ethical formula is really hard. It seemed profit starts to scale exponentialy just beyond the line. (Acepable would be something like 1TB worth of gamedemos)

miohtama 3mo ago

This is why Google/Meta is pushing for "age verification". 1. They want more as targeting data on you 2. They want to reduce bot clicks It's an unholy alliance with governments who want to know who writes what online.

inigyou 3mo ago
I'll take residential proxies over mass surveillance any day. It seems surveillance will always expand unless countered.

neves 3mo ago

I really don't mind anymore. My Roku stick is now owned by extreme right Fox Corporation. Chinese ad click network are petty villain compared.

wao0uuno 3mo ago

If you have a Raspberry Pi 5 gathering dust somewhere and need a new streaming box then try LibreELEC. It decodes 4k content just fine. It has HDMI CEC. It can stream from local server or play directly from attached storage. There are no ads or tracking/profiling. It can play YouTube without ads but there is no support for Netflix, Apple TV or similar streaming services.

dspillett 3mo ago
A Pi4 does the job well too. They can be had noticeably cheaper than Pi5s ATM, if you don't have the luck of having a device lying around ready to be repurposed, and even the 1Gb models are plenty sufficient. A Pi3 may suffice even, that is what I ran Kodi on before upgrading it to the Pi4, though the lack of hardware x265 decoding support is a limiting factor there (IIRC it'll manage 1080p in software, but only if you have some good cooling installed otherwise things get very skippy after a short while as thermal throttles kick in).
- wao0uuno 3mo ago
  I’m pretty sure Pi 4 struggles with 4k decoding. It can work but is less than ideal. I also wouldn’t recommend buying a new Pi these days. Prices are insane.
  - dspillett 3mo ago
    Most of what I watch is 1080p (I don't really have 4K capable eyes!) but it definitely plays 4K 265 well. Only 265 though, the hardware support for 264 is limited to 1080 so 4K there means software decoding which I imagine being a problem much like 265 on the Pi3. It is pretty rare to see 264 used for 4K content though, in my experience.

joeisnotjane 3mo ago

Ah, it's about "China, China.." Preparing casus belli.. first, open weights LLM which are "not secure", now "TV sticks".. Oh joes and janes, who will put finally some sense into you..

Ikatza 3mo ago
Ah, yes, the great TV sticks war of 2028. We'll tell the stories.
- joeisnotjane 3mo ago
  It is about gradually, but constantly, creating the image of an "evil adversary".. Venome drop after venome drop.. China is not doing that as far as I know. Neither Russia did it before the war, though you were claiming the contrary (I know, since I live in the west and could compare news from both sides, being a native Russian speaker).

inigyou 3mo ago

Krebs fails to make any case for why someone wanting to watch movies and TV should give a shit. I get that these products are personally inconvenient to Brian Krebs and his work, and to companies that make money blocking people from accessing the internet, and to companies that make money spewing ads in people's faces. So? Why should anyone care about any of those? In fact I think some people would get one of these sticks just to inconvenience the latter two groups!

AlexandrB 3mo ago

This is only slightly more malicious than the software "Smart TVs" already ship with.

stevetron 3mo ago

Birds Nest soup with Chinese tomatoes? Or Cinese noodles with Chinese tomatoes? It sounds likw 2 domestic markets that China should use to rid themseves of their over-abundance of tomatoes.

SnipeOfficial 3mo ago

[flagged]

coretx 3mo ago

The most relevant difference between using a TV and a "TV streaming stick" is corpos & the State controling the malware/surveillance device. Being a ordinary person, I do not want criminals or the ( ads/data ) industry or the state to be in control of my property. Also, any DRM not passed by a parliament undermines the rule of law & statehood. This is something Krebs and his Praetorian guard buddies must know.