Desmontando uma TV Box Comprometida

Sat, 07 Nov 2026 10:15:00 +0000

Also available in English: Taking apart a compromised TV box.

Essa é a metade técnica. A parte um é a versão em português claro, para quem só quer saber se precisa se preocupar com a box da sala. Essa aqui é a tarde como ela foi: os comandos, as saídas, as duas vezes que eu matei o meu próprio shell, e a briga de política do SELinux que eu acabei perdendo de propósito.

Taking Apart a Compromised TV Box

Sat, 07 Nov 2026 10:00:00 +0000

Também disponível em português: Desmontando uma TV Box Comprometida.

This is the technical half. Part one is the plain-language version for people who just want to know whether to worry about the box in their living room. This one is the afternoon as it actually went: the commands, the output, the two times I killed my own shell, and the SELinux policy fight I eventually lost on purpose.

Everything below happened on 2026-11-04. Times are GMT-3. The box isn’t mine; it was brought to me to look at, and the whole investigation ran at my place with the box on an isolated VLAN, no route to the rest of the LAN. Its way out to the internet I left open on purpose: I wanted to see what the app actually streamed and how the botnet behaved, and neither of those is observable on a box with nowhere to go. I’m not naming the IPTV app, for reasons I’ll get into near the end; the malware family is public and well documented, so that part is named. Addresses on my own network have been replaced with made-up ones. Every external address, domain and hash is real, because those are the parts you might need to match against.

Selinux on Odilon Junior

Desmontando uma TV Box Comprometida

Taking Apart a Compromised TV Box