Read this before you buy that TV streaming stick

Do you have a link to the projector?

I hesitate to blame the victim here, but why on earth would you do that? “$40 Chinese-made” didn’t give you pause?

I dare not ask why you would do such a thing, instead, I will simply ask if you now think the reason was good, and I will hint at you that if the reason was "convenience", then you should answer "No".

A guy in Vietnam mentioned that one of the largest ISPs there used these really dodgy Chinese modems which were so notoriously insecure that it was apparently common knowledge that you should replace them if performance was slow because that was a sign that yours was being used by a botnet. Apparently the cost of access to one of those nodes was so low that the spammers don’t even really monitor their bots.

So yes, I do want to blame the purchasers of these things, sometimes. To prove her point that her stamps were legitimate, she mailed me a card using one of her half priced (but likely fake) stamps and it made it through!

It’s not like they’re buying these things out of a car trunk in a dark alley. These retailers need to be held liable for selling these things. If they sell this stuff, why not illicit drugs?

If they are unable to maintain control of 3rd party sellers, then they should end the 3rd party seller program. It has done nothing but damage Amazon’s reputation, and it just keeps getting worse.

There are lots of people alive who grew up during the days of broadcast TV and radio. I get why they might not understand the difference.

From a link above to the story on darknetdiaries:

> For Pokemon, there is a website that tells you how to watch this. You start off on Netflix, then swap over to the Pokemon streaming service, which is the only place that has Season 2, then swap over to Prime Video for Seasons 3 through 5, swap to Freevee, then Hoopla. Season 13 is only on Amazon, though. Then swap to Tubi, then Hulu, then Roku channel, and then finally back to the Pokemon streaming, and then Netflix. Easy.

That's 8 different streaming services to view one series.

It's difficult to judge the price of media products. We have legal music streaming services that charges you an album's worth of money a month and lets you listen to millions of songs. You can pick up old AAA games for less than ten bucks. I'd say when people say that price tag, they don't think they get scammed into being a part of a botnet. They think the device manufacturer cut a good deal with the media rights holders.

It's worth separating the two populations:

My users had money and had considered legal subscriptions. They paid me because the legal product was worse—in my case, sports blackouts, a bunch of different apps, etc. They knew what they were buying into and they had weighed the risk. I can tell you right now some of my former users have bought into this market.

Then there's the unwitting: a person buying one of these devices at a too-good-to-be-true price is treating it as a hardware purchase from Amazon, where the actual monetization isn't inferable from the listing. Calling it too good to be true assumes the buyer can see what shit they're standing in. They can't. There's no visible market here. It's just a product page with reviews.

To add to this: the proxy exit is exactly why these cost so little. Demand for residential IPs is booming (check some of the proxy subreddits to see what I mean).

The ironic part is that there's a chance the person who bought one of these boxes to watch pirated sports was the exit node I was using to acquire the feeds in the first place.

[1] Can someone explain what the theory of the product is here? It sounds like they’re marketing these things as ways for the customer to commit fraud, for example by connecting to someone else’s login. How else would the customer expect to be able to get free Netflix or whatever?

Anyway, I think some level of blame is warranted.

It reminds me of the saying: "It Is Difficult to Get a Man to Understand Something When His Salary Depends Upon His Not Understanding It".

If these people thought about it for a few minutes, they would understand, but they choose not to, as ignoring it is too advantageous.

I admit I was tempted, as the price of all streaming services goes up, and services become more and more fragmented. During the same period where I have not had a raise.

Stremio +Torbox is $3/month and they can probably share 10+ households on one TorBox account so it could work out. The seller could just stop paying the TorBox subscription at whatever point and they have an incentive to do so.

The only winner here is the scammers running the fake affiliate sites on which these sticks are "clicking". Or, am I missing some facet of this enterprise?

but compare running tor nodes, and especially exit nodes. that surely would be a good thing, so at least if you think tor is good then running a proxy should be the same and it should be normalized.

doing it in secret without the user knowing is what's bad

Is it a graphic that's shared? Something else? I am sure we all know or have heard of people with these devices that promise free streaming.

I mean, I don't believe VLAN's were designed with security as a goal, and I wonder how "strong" the virtual wall between two VLAN's actually is?

Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel?

Just wondering.

https://github.com/synthient/public-research/blob/main/2026/...

This is the problem with being an “everything store”. “Everything” includes a lot of things most consumers would like to be protected from, and assume they are due to the long history of retailers standing behind the products they sell. That history seems to have come to an end. They only stand behind it enough to offer a refund if there is a problem, not to ensure it’s good before selling it.

Hell, there's a section of comments that would probably going "hey, RELAX guy" because it's not US companies doing this. For any American companies that do this though, sure - block/suspend/prosecute.

Once a vendor has been notified that these units are doing these sorts of things they will stop selling them. Its sadly very prescriptive in that if Newegg gets a notice that "WatchFunTV" streaming sticks are doing this, they will remove that brand but if the same hardware shows up from the same vendor as "SuperTVStreamer" or some such, that product won't be banned until someone does the test and then notifies the sellers. It's cat and mouse all the time.

Now the people who could do something about it, the ad networks like Google, do not do anything because ad revenue is ad revenue, people buying the ads cannot prove that the click was false so hey who can say it was? Which is why ad fraud is a perennial favorite of crooks. The people being ripped off don't have any way to prove it without a lot of support from the ad network traffic data which is "proprietary". Really stupid ad fraud gets shut down, but put a bit of care into it so that the Ad network and claim ignorance? You can do that all day. Just don't get greedy and try to pull in more than say 30 or 50 thousand dollars a month. Remember, the IAB said in 2025 alone Ad Revenue was $300B[1] so 2% of that is only $6B and any network with 2% or less of undetected fraud is considered a "high quality" ad network.

So yeah, ad fraud is the gift that keeps on giving.

[1] https://www.iab.com/insights/internet-advertising-revenue-re...

Now that's very different from "we are selling things that we know, or have good reason to know, specifically are dangerous" — here they might very well be liable.

Voters don’t like seeing themselves or their kids get hurt, but they do like lower cost live sports.

"Money talks. And bullshit brothers walk a marathon."

Sketchy devices on your wi-fi don’t really harm anyone. They’re a minor inconvenience at best, mostly to large corporations that like to discern residential connections from business/corporate ones.

I suspect these TVs either come with residential proxies set up from the factory, or they have such poor security that they’re instantly hacked. Either way, TV manufacturers (including reputable ones like LG) are to blame.

Personally, I think every other country should ban any product made by Google, Amazon, and Microsoft since they all spy on the users of their products too.

I switched to a Google box, this has no bloatware and this way I get tracked only by one company.

The devices are used to sell proxy services and scam advertisers. This doesn't even need particularly large organised crime. It would certainly be easier than large scale illicit drug importation and retail, which is happening all the time.

Could China exploit these streaming sticks if it wanted to? Maybe, but no more than any other nation.

A Pi3 may suffice even, that is what I ran Kodi on before upgrading it to the Pi4, though the lack of hardware x265 decoding support is a limiting factor there (IIRC it'll manage 1080p in software, but only if you have some good cooling installed otherwise things get very skippy after a short while as thermal throttles kick in).

That is not enough. You need to air gap devices that have legitimately no business communicating with anyone or anything outside the house. TVs, thermostats, and other Internet-of-Crap gadgets do not need "firmware updates." Either they work out of the box, offline or within the LAN, or they get sent back for a refund wherever they came from.

These sticks leave the factory with malware pre-flashed, the postman brings them to your door with zero risk for the beneficiary.

> Harm to the user: none^

Well, they are losing some of their bandwidth. They might not notice, but something which is rightfully theirs is being taken without consent.

I am not shedding any tears for the ad companies, but I don't exactly expect or want a consumer device to be doing this in the background without the owner's knowledge.

Most Americans are at a greater threat of harm from their own government that a foreign one. What worries me is all the mass surveillance done by big tech which bypasses the 4th Amendment and gives the government Americans data without a warrant.

There's already a front door with the adtech for US alphabet boys. This could likely be collected by others as well. We saw this happened where foreign hackers exploited a backdoor designed for American authorities[1]. This is what experts are referring to when they say there's no backdoor only for me.

This could be compelling to politicians, though, and would certainly be a step in the right direction.

>- any telemetry or data collection, or updates must be opt-in only and disabled by default

This should be how it is for everything foreign made software or not. Would be very hard to get done with the big tech lobby in the US.

[1] https://techcrunch.com/2024/10/07/the-30-year-old-internet-b...

Are there a lot of missiles that travel slowly enough to be able to guide themselves via watching for nearby wifi signals?

> for every imported device having a CPU and Internet connectivity

Why limit this to imported devices?

Ad companies generally try to detect fake clicks, but any fake clicks that get through just earn money for the ad company (at the cost of making the advertisers campaign have a lower ROI)

Is this sarcasm? GPS can take several minutes to get a location, and works poorly indoors. One of the reasons why Google Maps is so quick and precise is because Google has gathered exactly this data through users and Street View drive-bys.

Could it be used for missiles? Sure. Is it obviously the intention? No.

Yeah, it's like—a cheap streaming stick AND it poisons the advertising well? I'm pretty happy with my Fire TV Stick, but they're really tempting me here.

The Snowden leaks showed that the US was already doing this. I'm certain that everything purchased is already infected with something. Most likely bugs and bad security.

If you just want to spam clicks on ads you don't financially be edit from, go for it.