4 ms·

In this case it’s actual malice, that the streaming stick is set up for residential proxy and ad fraud straight from the factory. But incompetence can lead to t

In this case it’s actual malice, that the streaming stick is set up for residential proxy and ad fraud straight from the factory. But incompetence can lead to the same place if it’s a poorly engineered, un-maintained device with an old version of Android that will never be patched and is always one no-click exploit away from being commandeered into residential proxy and ad fraud.

alex_duf 2mo ago
I wonder to what degree malice can be engineered to look like incompetence?
- abbeyj 2mo ago
  Try examining the old entries from the https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest.
FinnKuhn 2mo ago
Those TV streaming boxes really are (from a cybersecurity perspective) probably one of the worst things you can buy. Here is the "Darknet Diaries" Episode on them: https://darknetdiaries.com/episode/172/ https://darknetdiaries.com/episode/172/
- labbett 2mo ago
  Superbox 3 is coming up at DEF CON next Friday! https://hackertracker.app/defcon34/content/67257 https://hackertracker.app/defcon34/content/67257
  - doctorspazz 2mo ago
    Thank you for sharing this. The superbox investigations have been incredibly interesting to follow.
frollogaston 2mo ago
Since these are poorly engineered, wonder how easy it'd be to reverse-engineer one and just get the free streaming on a non-scam device.
- dpoloncsak 2mo ago
  If it's something like a Firestick (or the knock-off featured in the article), you're really just connecting to Content Provider servers to handle auth and content streaming, right? They're just OSes designed to run Netflix and Hulu. Would be hard to spoof I think
  - mikepurvis 2mo ago
    Indeed. Owning the streaming box lets you loose on whatever network it's on, but it doesn't actually get you inside the content gardens; those are separately managed by teams of people much more motivated to protect their IP.
- kiririn 2mo ago
  See CoreELEC/LibreELEC/etc - totally replaces the (potentially dodgy) Android OS on these kind of streaming boxes with a stripped down Linux+Kodi setup
  - qmr 2mo ago
    I thought those were for x86? They run on ARM TV boxes / sticks now?
    - tesnorindian 2mo ago
      LibreElec also supports ARM builds than can run on SBC like Raspberry Pi. While CoreElec is exclusively for Amlogic ARM processors.
- wildzzz 2mo ago
  Best case, you can grab the credentials off the Kodi box and use them on a clean install. Worst case, everything is packaged up in a single app so it's all or nothing. Although you could just wipe the box and find another pirate TV provider.
acdha 2mo ago
I was trying to figure out why we saw so many fraudulent applications from Vietnam for a service which is restricted to the United States, especially because they were all getting rejected - it seemed like even the laziest spammer would lose interest in something they couldn’t monetize. A guy in Vietnam mentioned that one of the largest ISPs there used these really dodgy Chinese modems which were so notoriously insecure that it was apparently common knowledge that you should replace them if performance was slow because that was a sign that yours was being used by a botnet. Apparently the cost of access to one of those nodes was so low that the spammers don’t even really monitor their bots.
8note 2mo ago
consumers are however happy to buy a cheaper stick with an overall public bad
- inigyou 2mo ago
  I don't even think it's a public bad. I think attacking internet gatekeepers like Cloudflare is objectively a public good. So is attacking legal spam companies.
  - psd1 2mo ago
    ...ish. Attacking their monopoly, great. Attacking their workers by bombing an office, not so great. Throwing ever more spam traffic across the tubes isn't a attack, it's marketing on their behalf.
    - inigyou 2mo ago
      In what way is clicking an ad like bombing an office?
      - psd1 2mo ago
        I think i was clear, but I'll try again. You said this: > attacking internet gatekeepers I think we agree that you don't mean all kinds of attack. The agreed exception is bombs. I put it to you that throwing bot traffic around is another kind of attack that you do not want, because it drives product sales. You would be doing them a favour.
inigyou 2mo ago
What is the malice in those things?

alex_duf 2mo ago

I wonder to what degree malice can be engineered to look like incompetence?

abbeyj 2mo ago
Try examining the old entries from the https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest.

FinnKuhn 2mo ago

Those TV streaming boxes really are (from a cybersecurity perspective) probably one of the worst things you can buy. Here is the "Darknet Diaries" Episode on them: https://darknetdiaries.com/episode/172/ https://darknetdiaries.com/episode/172/

labbett 2mo ago
Superbox 3 is coming up at DEF CON next Friday! https://hackertracker.app/defcon34/content/67257 https://hackertracker.app/defcon34/content/67257
- doctorspazz 2mo ago
  Thank you for sharing this. The superbox investigations have been incredibly interesting to follow.

frollogaston 2mo ago

Since these are poorly engineered, wonder how easy it'd be to reverse-engineer one and just get the free streaming on a non-scam device.

dpoloncsak 2mo ago
If it's something like a Firestick (or the knock-off featured in the article), you're really just connecting to Content Provider servers to handle auth and content streaming, right? They're just OSes designed to run Netflix and Hulu. Would be hard to spoof I think
- mikepurvis 2mo ago
  Indeed. Owning the streaming box lets you loose on whatever network it's on, but it doesn't actually get you inside the content gardens; those are separately managed by teams of people much more motivated to protect their IP.
kiririn 2mo ago
See CoreELEC/LibreELEC/etc - totally replaces the (potentially dodgy) Android OS on these kind of streaming boxes with a stripped down Linux+Kodi setup
- qmr 2mo ago
  I thought those were for x86? They run on ARM TV boxes / sticks now?
  - tesnorindian 2mo ago
    LibreElec also supports ARM builds than can run on SBC like Raspberry Pi. While CoreElec is exclusively for Amlogic ARM processors.
wildzzz 2mo ago
Best case, you can grab the credentials off the Kodi box and use them on a clean install. Worst case, everything is packaged up in a single app so it's all or nothing. Although you could just wipe the box and find another pirate TV provider.

acdha 2mo ago

I was trying to figure out why we saw so many fraudulent applications from Vietnam for a service which is restricted to the United States, especially because they were all getting rejected - it seemed like even the laziest spammer would lose interest in something they couldn’t monetize. A guy in Vietnam mentioned that one of the largest ISPs there used these really dodgy Chinese modems which were so notoriously insecure that it was apparently common knowledge that you should replace them if performance was slow because that was a sign that yours was being used by a botnet. Apparently the cost of access to one of those nodes was so low that the spammers don’t even really monitor their bots.

8note 2mo ago

consumers are however happy to buy a cheaper stick with an overall public bad

inigyou 2mo ago
I don't even think it's a public bad. I think attacking internet gatekeepers like Cloudflare is objectively a public good. So is attacking legal spam companies.
- psd1 2mo ago
  ...ish. Attacking their monopoly, great. Attacking their workers by bombing an office, not so great. Throwing ever more spam traffic across the tubes isn't a attack, it's marketing on their behalf.
  - inigyou 2mo ago
    In what way is clicking an ad like bombing an office?
    - psd1 2mo ago
      I think i was clear, but I'll try again. You said this: > attacking internet gatekeepers I think we agree that you don't mean all kinds of attack. The agreed exception is bombs. I put it to you that throwing bot traffic around is another kind of attack that you do not want, because it drives product sales. You would be doing them a favour.

inigyou 2mo ago

What is the malice in those things?