Living With Kodi And A Hole In Your Network
summary
Shows a working exploit that hijacks Kodi’s HTTP-based update flow by replacing addons.xml and the ZIP with a malicious service.py Python payload that runs on install (demo payload writes a desktop file and executes it). Uses MD5/versioning to push updates, sinkholes extension domains and collects telemetry — about 802000 unique IPs in 7 days, mapping to ~2000 entities across 85 industries (4000 IPs in Portugal). Recommends segregating devices and forcing HTTPS for addon updates.
AI-written summary · about
chapters (7)
- 0:00Introduction to Kodi
- 2:06Demonstrating add-on risks
- 3:36Plugin development basics
- 6:05Crafting malicious plugins
- 8:37Man-in-the-middle attacks
- 11:14Scope and impact analysis
- 14:42Mitigation and conclusion
related talks
46mAttacks, Lies and the Underground World
24mTrusting SDKs
28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System Takeovers
59mCounter-Infiltration: Future-Proof Counter Attacks Against Exploit Kit Infrastructure
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
43mTrusting SDKs
45mOutside the box: pwning IoT devices through their applications
29mMalware Development: Asynchronous Backdoor Built on Public APIs