Hacker News Reader

Comment by mortenjorck | Hacker News Reader

In this case it’s actual malice, that the streaming stick is set up for residential proxy and ad fraud straight from the factory. But incompetence can lead to the same place if it’s a poorly engineered, un-maintained device with an old version of Android that will never be patched and is always one no-click exploit away from being commandeered into residential proxy and ad fraud.

View on HN

Those TV streaming boxes really are (from a cybersecurity perspective) probably one of the worst things you can buy. Here is the "Darknet Diaries" Episode on them: https://darknetdiaries.com/episode/172/

Superbox 3 is coming up at DEF CON next Friday!

https://hackertracker.app/defcon34/content/67257

Thank you for sharing this. The superbox investigations have been incredibly interesting to follow.

I was trying to figure out why we saw so many fraudulent applications from Vietnam for a service which is restricted to the United States, especially because they were all getting rejected - it seemed like even the laziest spammer would lose interest in something they couldn’t monetize.

A guy in Vietnam mentioned that one of the largest ISPs there used these really dodgy Chinese modems which were so notoriously insecure that it was apparently common knowledge that you should replace them if performance was slow because that was a sign that yours was being used by a botnet. Apparently the cost of access to one of those nodes was so low that the spammers don’t even really monitor their bots.

Since these are poorly engineered, wonder how easy it'd be to reverse-engineer one and just get the free streaming on a non-scam device.

If it's something like a Firestick (or the knock-off featured in the article), you're really just connecting to Content Provider servers to handle auth and content streaming, right? They're just OSes designed to run Netflix and Hulu. Would be hard to spoof I think

Indeed. Owning the streaming box lets you loose on whatever network it's on, but it doesn't actually get you inside the content gardens; those are separately managed by teams of people much more motivated to protect their IP.

See CoreELEC/LibreELEC/etc - totally replaces the (potentially dodgy) Android OS on these kind of streaming boxes with a stripped down Linux+Kodi setup

I thought those were for x86? They run on ARM TV boxes / sticks now?

LibreElec also supports ARM builds than can run on SBC like Raspberry Pi. While CoreElec is exclusively for Amlogic ARM processors.

Best case, you can grab the credentials off the Kodi box and use them on a clean install.

Worst case, everything is packaged up in a single app so it's all or nothing. Although you could just wipe the box and find another pirate TV provider.

I wonder to what degree malice can be engineered to look like incompetence?

Try examining the old entries from the https://en.wikipedia.org/wiki/Underhanded_C_Contest.

What is the malice in those things?

consumers are however happy to buy a cheaper stick with an overall public bad

I don't even think it's a public bad. I think attacking internet gatekeepers like Cloudflare is objectively a public good. So is attacking legal spam companies.

...ish. Attacking their monopoly, great. Attacking their workers by bombing an office, not so great. Throwing ever more spam traffic across the tubes isn't a attack, it's marketing on their behalf.

In what way is clicking an ad like bombing an office?

I think i was clear, but I'll try again. You said this:

> attacking internet gatekeepers

I think we agree that you don't mean all kinds of attack. The agreed exception is bombs.

I put it to you that throwing bot traffic around is another kind of attack that you do not want, because it drives product sales. You would be doing them a favour.

Reply on news.ycombinator.com