Linus Tech Tips Discussion

 Kimwolf botnet thriving in cheap Chinese Android TV devices About years ago, LTT published "Stop Buying ANDROID TV Boxes", which talked about how these devices ship with malware and are in general a security nightmare. Well, here we are two years later and Brian Krebs is gnawing on a truly horrific security story that is the direct descendant of that video.   Now we get this, from Krebs on Security: The Kimwolf Botnet is Stalking Your Local Network.    Quotes Quote The past few months have witnessed the explosive growth of a new botnet dubbed Kimwolf, which experts say has infected more than 2 million devices globally. The Kimwolf malware forces compromised systems to relay malicious and abusive Internet traffic — such as ad fraud, account takeover attempts and mass content scraping — and participate in crippling distributed denial-of-service (DDoS) attacks capable of knocking nearly any website offline for days at a time. More important than Kimwolf’s staggering size, however, is the diabolical method it uses to spread so quickly: By effectively tunneling back through various “residential proxy” networks and into the local networks of the proxy endpoints, and by further infecting devices that are hidden behind the assumed protection of the user’s firewall and Internet router. The botnet thrives on the same cheap Android TV boxes Linus talked about in the video, but also in digital picture frames and other sketchy, Chinese-manufactured Android-powered devices. In addition to creating residential proxy networks that allow Kimwolf to spread behind our homes' firewalls, these devices often ship with Android Debug Bridge (ADB) enabled by default which allows post-purchase firmware updates and many other shenanigans.   Follow up video idea for LTT - get Benjamin Brundage, the 22 year-old RIT undergrad and security firm founder whose Kimwolf research blew this story wide open,  in a video to talk about what he's found and how dangerous this botnet is. I think he and Krebs are onto something that could blow up even more than it already has.