Just a security heads up

[jack616]

as my online monitoring has revealed a continuing uptick in certain activities I just
thought I'd give a heads up of recent reports on a specific issue

a third party site reports:
" News
By Sead Fadilpašić published 10/06/2025

Mirai operators are hunting for new devices, experts warn... "

As I have seen this attack (log start as ) "POST /device.rsp?opt=sys&cmd=_S_O_S_T_R_E_A_MAX"
on 3 of my online linux servers I thought I'd mention it. Be careful people.
Use duckduck if you want further info.
------------------------------

 

[Black Hole]

Really? Are you suggesting our HDR-FOXes are susceptible?

 

[jack616]

;-) ... Just a note that specific work is going into certain types of devices ...
But then again -anyone using windows past V7 doesn't have a firewall either
no matter what they do anyway. But DVR's are becoming the target of choice
right now it seems.

 

[/df]

Affected devices are TBK DVR-4104 and DVR-4216 (CCTV recorders). If the attack request reaches a LAN with a CF HD/R Fox T2, this just happens:

$ curl -v --data '' 'http://humaxhdr.local/device.rsp?opt=sys&cmd=_S_O_S_T_R_E_A_MAX'
*   Trying x.x.x.x:80...
* Connected to humaxhdr.local (x.x.x.x) port 80 (#0)
> POST /device.rsp?opt=sys&cmd=_S_O_S_T_R_E_A_MAX HTTP/1.1
> Host: humaxhdr.local
> User-Agent: curl/7.88.1
> Accept: */*
> Content-Length: 0
> Content-Type: application/x-www-form-urlencoded
> 
< HTTP/1.1 200 OK
< Content-Type: text/html; charset="UTF-8"; no-cache
< Expires: -1
< Connection: close
< Pragma: no-cache
< Cache-Control: no-cache
< Refresh: 5; url=/
< Transfer-Encoding: chunked
< Date: Thu, 03 Jul 2025 10:46:06 GMT
< Server: Humax
< 

<... WebIf homepage HTML ...>

* Closing connection 0
$

So no worries there.

 

[Black Hole]

Thanks for that. I expected our Hummies would be too smart/dumb to respond in the required manner.

I suppose the specific target devices are programmed with a "_S_O_S_T_R_E_A_MAX" executable for some reason, which does something convenient for hackers (and perhaps Chinese overlords).

 

[prpr]

Why anyone thinks a custom web interface for a Humax box is going to respond to some hack for a TBK DVR is beyond me though.
But the OP seems to have form about posting vague, unsubstantiated, irrelevant rubbish.

 

[jack616]

Oh dear... Are you all having a rachael reeves day today?

The point being made was new specific TYPES of devices are being targetted with more than normal
interest - but by all means carry on pretending you're immune from interest.

 

[Black Hole]

You've posted in the HDR-FOX section of the forum. If you intended this to be information non-specific to HDR-FOX, you should be posting in the relevant section or Hummy Arms. The context is gleaned from the forum subject area, so it's your own doing.