New, by me: Read This Before You Buy That TV Streaming Stick

[pandaninjas@infosec.exchange]

@maya_b @adamshostack @briankrebs Ad Nauseam doesn't actually cost the advertisers any money, and it probably doesn't end up poisoning the data, because it sends a single AJAX request to the ad networks. Most ad networks ignore clicks where the browser didn't stay on the page for seconds.

[h0ru2@cyberplace.social]

@briankrebs Darknet Diaries had an episode on such a device, I think called Superbox. It was wild, it kicked other devices off the network and tried to take their place. Owners were trying to isolate or secure them, so they could keep using these things instead of throwing them out.

[acdha@code4lib.social]

@radioclash @tessarakt @briankrebs I mean, many of them learn not to but that still doesn't change the fact that someone who's good at making coffee or giving haircuts mistakenly thought that a much larger company was selling what they claimed to be selling. We shouldn't celebrate market failures.

[n_dimension@infosec.exchange]

@adamshostack @briankrebs

As a small business owner we tried online advertising. Hundreds of dollars down the toilet.
Not a single sale.

[felix@mastodon.nz]

@briankrebs thanks for this Brian, I really do enjoy your work

[shadsterling@mastodon.social]

@briankrebs I only vaguely remember, but several years ago I was reading about the possibility of TV sticks getting power from the TV’s HDMI port… I think I found that there was a spec for it but few devices supported it. If that had caught on this abuse would be harder, but maybe that’s why it didn’t. (Instead we have “smart TVs” that have the abuse built in!)

[worik@mastodon.social]

@briankrebs One of the fabulous side effects of the "AI" boom is the decay of the ad supported web

Counting eyeballs is, was and always will be an awful metric

[pressure@surf.social]

@briankrebs

Did you guys see Jalen Milroe had his first really good practice?

[w_hurless@mastodon.social]

@briankrebs A long time ago, around 2010, I would get a Android TV box, flash the firmware to something better, and then install a bunch of emulators, they worked great for a low cost emulation device.

[garlickles@infosec.exchange]

@briankrebs I linked this article to a family member, who finally became convinced to take it off his network. Thanks for writing this.

[bbbhltz@framapiaf.org]

@briankrebs My father-in-law uses things like this. He talks about them like they're amazing things. But the thing he bought charges a yearly fee and asked for ID too, so they have his banking info, address, passport, etc. He doesn't understand why I wouldn't want one...

[raymaccarthy@mastodon.ie]

@dryak @briankrebs
It's not like formatting a storage device. Or even like installing OpenWRT on a router. These may have locked or custom bootloaders. See variable difficulty of replacing ChromeOS.
I simply would never buy such a device and probably not the branded Amazon, Google etc varieties. It may be less convenient, but I'd use a laptop or PC. Some may use a Raspberry Pi, but I find a 10 year old laptop more functional.

I never connect TV WiFi or Ethernet for similar reasons.

[jschwart@mas.to]

@miff @briankrebs on some of these boxes you can run Armbian. If an official build doesn't work, in the forum there are some unofficial builds for specific TV boxes. (They are not the intended target.)

Funny thing that the article mentions Google, but it's software is essentially malware as well and had best be disabled on Android devices. The only trustworthy source for applications on Android is F-Droid.

Also note that these boxes themselves are also used by legitimate TV services. The specifics is in the software and you can likely find a way to remove the malware if you happen to have an affected box. If that malware is tied to some illegitimate TV application, you'd possibly lose access to that service. Generally these boxes are simply cheap and won't be affected, but you're always taking a risk when any proprietary software is involved.

[salvo@mastodon.social]

@briankrebs
using people’s internet connections for fraud
causing the collapse of the “Internet Advertising” industry

[glaskows@mastodon.gamedev.place]

@briankrebs If those can be rooted they could be a pretty nice Linux SBC.

[avincentinspace@furry.engineer]

@briankrebs If you want unlimited access to content without recurring fees, there are only two ways.

Buy physical media, or torrent.

Neither are particularly hard.

[lukefromdc@kolektiva.social]

@mo @briankrebs @adamshostack Remember this: You do NOT fall into one of the widely known cases such as "tor exit node" or "open public wifi." If someone accesses CSAM through your TV and especially if you were previously unaware of this, you could sit in jail unable to post a huge bond until some investigator thinks to check out your TV. If that doesn't happen, you may even get convicted of CSAM you had nothing to do with.

[amilatled@snac.la10cy.net]

@armbian@fosstodon.org has many community builds for SoC's used in those tv boxes (https://github.com/armbian/community/releases). My two boxes from 6-7 years ago with a quad AMLogic S905W and 2GB RAM are still running just fine with latest armbian Speed for those is comparable to a RPI3

CC: @briankrebs@infosec.exchange

[lumiworx@mastodon.social]

@radioclash @maya_b @devnull @adamshostack @briankrebs

I've been using #Technitium for years now on a linux box and point it to Quad9 as the upstream DNS. I don't often get to say this, but so far it keeps happily doing its thing in the background with no muss or fuss.

I watch the dashboard to check the stats and to watch for occasional updates, but it absolutely does the job it was designed for. 4 Million+ sites in blocklists, scheduled to auto update every 2 hours... & zero lag.

[vatvslpr@c.im]

@devnull @maya_b @adamshostack @briankrebs
I've had excellent results with Privacy Badger from EFF. It technically blocks trackers rather than ads, but it's very rare to encounter an ad that doesn't track you these days.