Rampant Kodi Malware? It’s Time to Either Put Up or Shut Up

Faced with a tsunami of pirated movies and TV shows being accessed at will through millions of piracy-enabled set-top boxes, entertainment industry groups have had to come up with a new anti-piracy strategy.

The main goal seems to demonize these devices in the press, creating the impression that anyone using them puts themselves in danger, either due to fire risk or exposure to the perils of viruses and malware.

These claims are perfect tabloid material. Newspapers, particularly in the UK, gobble up press releases and quickly spin them out, whether they have any substance to them or not. While there’s little evidence that the scare stories are working as a deterrent among the pirating masses, they are a continuous source of irritation for those who know better.

This week a new Kodi-related video appeared on YouTube. Filmed at the RSA conference and presented by CyberScoop editor Greg Otto, it consists of a short interview with Kurtis Minder, CEO of security company GroupSense. “How malware is growing on the Kodi/XMBC platform” was the topic.

After a brief introduction on so-called ‘Kodi boxes’, Otto put it to Minder that his company had been looking into the “malware that has been floating through these boxes” and asked him to elaborate.

Minder said his company started its research around two months ago, working with the Digital Citizens Alliance (DCA). Of course, DCA has been one of the main sources of Kodi-related malware stories, ostensibly for the protection of consumers.

However, DCA is affiliated with the entertainment industries and there is little doubt they’re being used to promote an anti-piracy agenda. There is nothing inherently wrong with companies trying to protect their content, of course, but doing so in a way that has the potential to mislead the public is bound to raise questions.

Back to the video, Minder told interviewer Otto that his company had been looking at “what the attack footprint would be for malware on the media that would show up on any given Kodi box that would be in someone’s home.”

It’s a curious statement to talk about the streaming media itself providing an attack vector but Minder doubled down, stating that they’d discovered several places on the dark web “where people are selling malware-enabled media.”

Otto didn’t ask Minder to elaborate on these claims and Minder didn’t respond to TF’s request for comment, so we still have no idea what he’s referring to. However, Otto did pour fuel on the confusion by asking Minder about malware which requires capabilities that no ‘Kodi box’ has.

“What happens with [that malware]? Is it a RAT [Remote Access Trojan] that takes over a TV that hooks up to a camera and is almost like spyware? Is it ransomware? What are we seeing?” he asked the security expert.

“Some of that is [to be determined], we don’t know exactly what all of it does,” Minder responded. “But we do know there is a fair amount that enable DDoS capability from the boxes.”

We have no idea what constitutes a “fair amount” of malware but it sounds like multiple instances. Here on TF back in 2017, we broke the news that a single Kodi addon was programmed to repeatedly visit the websites of rivals.

In that single case, the architect of that addon quickly apologized for his actions, the whole thing was concluded inside a week, and we haven’t heard of any similar incident since. But Minder said there are additional risks too.

“There is malware that will actually take over some of the components. We don’t know to what extent, if it’s actually listening to the people in the room or not, that stuff hasn’t really been netted out,” he told Otto.

Indeed, such a thing has never been reported anywhere, not least since “Kodi boxes” don’t have microphones. But after more prompting from Otto, Minder then went on to talk about Kodi installed on platforms other than Android devices. His revelations about supposed ‘Kodi malware’ in this respect are also controversial.

“The delivery mechanism [for the malware] appears to be two primary ways. It’s the Kodi platform itself, which means whatever you load that on. For instance, if you did load that on an [Amazon] Firestick it could still be effective as an attack vector. The other one is the streaming media itself. Embedded in the media itself there are some malware variants,” he said.

As far as we know, malware embedded in streaming media that can be consumed via Kodi or indeed any regular media player is unheard of these days. Nathan Betzen, President of the XBMC Foundation, the group behind Kodi, told TorrentFreak that at least as far as he is aware, such a thing doesn’t exist.

“I’ve never heard of malware in a video stream. I guess anything is possible, but to my knowledge, there have been no reports to that effect,” Betzen said.

Bogdan Botezatu, Senior E-threat Analyst at BitDefender, also told TorrentFreak that he’d seen nothing like that in the wild.

“Malformed video could leverage vulnerabilities in the player itself, but I’m not aware of such attacks happening in the wild,” Botezatu told us.

“Actually, the last time I saw malicious videos distributed via torrent websites was years ago, back in the days when Trojan.Wimad was making the headlines.”

Trojan.Wimad was a trojan discovered in 2005 that was able to download remote files from websites by exploiting the Digital Rights Management (DRM) technology available in Windows. The trojan got onto users’ computers as a licensed-protected video file. Kodi users are certainly not interested in those and in any case, Android-based Kodi boxes are unaffected.

So, apart from the addon incident that lasted for a week in 2017, we’ve never heard of a live Kodi-related malware attack anywhere in the wild. Betzen told us that he’d heard of an instance where a coin miner had spread via third-party code but that’s an issue for thousands of mainstream websites too.

All that being said, we aren’t known as security experts, so we asked security firm AVAST if they could provide information on all Kodi-related malware incidents they have on record.

“Unfortunately, we have not observed any Kodi-related malware risks in the wild,” AVAST Communications Manager Stefanie Smith told TorrentFreak.

Bogdan Botezatu at BitDefender also had no specific instances to report.

“There has been a lot of attention towards Kodi in the past year and most of the ‘security risks’ go around the fact that some addons allow users to stream media directly from websites, so this is mostly a legal issue rather than a cyber-security one,” Botezatu said.

The BitDefender expert did, however, point us to a security advisory from CheckPoint which detailed a software vulnerability affecting Kodi, VLC, and other players using subtitles, which TF reported last year.

“Kodi 17.1 was known to have been vulnerable to a subtitle parsing bug that allowed an attacker to remotely control the Kodi box. This is one of the most serious threats I know of because third parties could rig subtitles uploaded to various repositories and this would go unnoticed for a while,” he said.

While this vulnerability could have been used for nefarious purposes, there is no evidence of it ever being exploited in the wild. And, in common with all responsible platforms, Kodi and all others involved fixed the issue before any damage could be done.

Moving through our list of vendors, TorrentFreak also asked Symantec if they had ever encountered any actual Kodi-related malware. The company told us they had nothing to report at this time but did highlight the same subtitle vulnerability pointed out by BitDefender.

To be clear, vulnerabilities can affect any software, including Windows, but that doesn’t make them inherently dangerous to the consumer as long as they’re disclosed and then fixed in a responsible and timely manner.

However, listening to the entertainment industries and those aligned with them, Kodi use presents an active and serious malware danger to the public, but one with almost zero evidence to support it.

Minder himself didn’t respond to our request for elaboration but we did manage to obtain a copy of a presentation his company prepared for the Conference of Western Attorneys General detailing supposed Kodi threats. The document, dated May 2018, makes for interesting reading.

Perhaps referencing the claims that Kodi malware is available on the dark web, the presentation slides show an advert discovered on the hidden ‘Dream Market’ marketplace. The advert offers subscriptions to an illicit IPTV service but it’s actually one that’s easily accessible on the regular open web. Perhaps most importantly, there is no mention of malware anywhere on the slide.

The next slide proved interesting since it covers a topic first published here on TorrentFreak at the start of 2018. We revealed how some Kodi setups can be accessed by outside parties if users aren’t careful about the settings for Kodi’s web interface. While this is a known issue, this has nothing to do with malware.

Finally, the last slide had this to say about Kodi and third-party Kodi addons.

“Unbeknownst to the consumer these third‐party add‐ons further introduces [users] to risks such as copyright violations, malware infection, disclosure of IP address and Internet behavior, and the loss of the confidentiality of their communications,” the slide reads (PDF).

While it can’t be disputed that copyright violations can take place, the ever-present malware claim isn’t backed up by any publicly-available information indicating that such an event has happened more than once or twice. To put that into perspective, the AV-TEST Institute says it registers over 250,000 new malicious programs every day.

Furthermore, IP addresses are always disclosed no matter what content users access online, so that point is moot too, along with the supposed issues with confidentiality of communications. However, GroupSense has more to add.

“Additionally, the communication between their Kodi application and the third‐party add‐ons are unencrypted and unauthenticated meaning that an attacker can introduce malicious code into the communication stream or compromise the third‐party add‐on before the recipient (consumer) receives the data; thereby, infecting their device to incorporate into a botnet or steal privileged information such as user credentials,” the slide reads.

We presented these claims to TVAddons, the world’s largest repository of third-party addons and the developer of many, past and present. They weren’t impressed with the claims.

“That argument is quite the stretch. Technically the same would apply to any website you visit that doesn’t use forced-HTTPS. Almost every unofficial add-on repository is hosted through GitHub, which forces encryption,” the site said.

“Kodi ‘boxes’ are used on home networks, not public Wi-Fi. By the time someone could perform a [Man-in-the-Middle] attack on your Kodi box, it would mean that they would have already had to compromise your router. If someone were to go through all that, they could likely do a lot more damage without even considering exploiting Kodi.

“Furthermore, most users use Kodi on their media boxes, where little to no privileged information would be present,” the site added.

Let’s be clear, every single piece of hardware and software, whether on or offline, can be exploited in some way by nefarious players or simply the curious. However, the persistent claim that Kodi users are somehow under constant malware attack isn’t borne out by any publicly available information.

Indeed, one of the world’s most popular anti-piracy vendors in AVAST says they have no record of ANY Kodi-related malware. And Marius Buterchi, PR Manager at the highly-respected BitDefender, couldn’t point us to any specific instances either.

“I just talked with the Lab guys and they told me that they actually haven’t seen any Kodi-related malware in the wild,” he told us Friday.

With that, it now seems the perfect time to either put up or shut up in respect of “Kodi malware.”

If there is malware out there affecting users of Kodi, security and entertainment industry companies making these claims should back them up with solid evidence because, as it stands, the horror stories seem designed to frighten the masses, rather than protect them.

The benefits of full disclosure, detailing the EXACT NAMES of the malware, WHEN they were discovered and by WHOM, and what EXACTLY THEY DO, would be two-fold.

Firstly, the aim of scaring people away from Kodi would have more impact, since the evidence of malware would be hard to ignore. That would be a big plus for the movie and TV industries who are quite rightly concerned about protecting their business.

Secondly, and just as importantly, Kodi users could take steps to protect themselves, which should be the number one priority of any group, organization, or company that claims to be acting in the best interests of consumers and the public in general.

With that in mind, we understand that the Digital Citizens Alliance will publish a new Kodi malware report in the coming weeks. Perhaps it will contain actual evidence of the malware being spoken of continuously in the media.

We would certainly welcome the publication of a specific and detailed list of all malware variants in the wild which specifically target Kodi users. At that point, we can alert the major anti-virus and malware vendors who currently appear to be strangely in the dark.

Update: Additional input from Mikko Hypponen from F-Secure.

“We had to do some research, as Kodi-based malware isn’t currently in our list of most prevalent things. There have been some public cases with some major plugins changing their code during update processes to execute something highly suspicious/malicious (e.g. Exodus creating a DDoS botnet). But apart from that, our findings came a bit short.

“From our viewpoint, this doesn’t appear to be a major threat.”