Themoviedb.org and Movie Scraper acting like Trojans
#1
Long time ago I installed Xbmc and it works fine. I also setup a Moviescraper, and all looks pretty fine.
No These days I tried to update the Film Posters. And I got Poster from complete unknown movies. Titels I never had seen on before. Because of the list is so small, I know every of my movies.
Now Nasty movie titels with sex and hateful background were found. Astonishing was that I now had ovbiously more titels in my list, than before, but these files were physically NOT existing.
And what would happen, If I would have pressed on -- I never dared that -- because I think a download of further viral code could follow.

At this time I had activated TheMovieDB.org Scraper and was astonished that I couldn't deaktivate nor deinstall it. So I had to delete it from Xbmc from disk. Now my xbmc was faster than ever.

Naturally I tried the Common Movie Scraper with the same result. Unknown movies with nasty content appear. But when I startet Whireshark I found a massive Communication with the ip
207.171.162.180 (a Amazon server). It looks that the scaper tries to download another programmcode so I cut the connection.

No I deactivated these scrapers at all.

Please check your sourcecode or the Metadata Source for these odd behavior.
Reply
#2
perhaps first start pointing at yourself instead of us?

you set content on some random folder or downloaded some random crap from somewhere instead of our official website
Read/follow the forum rules.
For troubleshooting and bug reporting, read this first
Interested in seeing some YouTube videos about Kodi? Go here and subscribe
Reply
#3
Sorry, that you think I will point on you, not at all.
To your question I downloaded it form the official side and within xbmc I activated the scrapers.

I work with Xbmc sine 2 year I never had someting like this, so I do not need to post anything.
And by the way I am not a rooky, I have studied Informatic sience and working in a big IT departent, and this is not the first case that I detected a Trojan.

In addition I do not download films from elsewere, I record it with my tvheadend server via DVB-S.
It's on you to look if there is a security hole in one of the scrapers or in the Metadata Source
I read there was a change in the search alogrythms of the scrapers, at the same time this odd behavior occurs.
And also strange is that this addon I could not be deactivate nor disabled. Maybe someone has hitchhicked the addon. The question is how could it be prevented ?
Reply
#4
not being able to disable is perfectly normal.
again there is absolutely nothing wrong with our code or contains trojans.
if there are trojans it's only possible from your end and not ours
Read/follow the forum rules.
For troubleshooting and bug reporting, read this first
Interested in seeing some YouTube videos about Kodi? Go here and subscribe
Reply
#5
(2014-12-21, 18:20)Jorgez Wrote: But when I startet Whireshark I found a massive Communication with the ip
207.171.162.180 (a Amazon server)
Code:
anepu:metadata.common.imdb.com anaconda$ host akas.imdb.com
akas.imdb.com is an alias for vacobranding.imdb.com.
vacobranding.imdb.com is an alias for us.dd.imdb.com.
us.dd.imdb.com has address 207.171.162.180
Reply
#6
oh so IMDb is a trojan Smile
better call them
Read/follow the forum rules.
For troubleshooting and bug reporting, read this first
Interested in seeing some YouTube videos about Kodi? Go here and subscribe
Reply
#7
Unlikely... I think it's just downloading arts and the likes. Scrapers only download XMLs and images and anyways have no ability to launch binaries.

I guess you'd need to check your video plugins...
Reply
#8
And what is about the Metadata Source, is the source proof ?
I saw it was analysing the well known Movie "Matrix" and got someting like Matrib.
Is there a possibility to check the integrity of the Addons ?
Did the scrapers accept even more Metadata sets as asked for ?
As I wrote, I erased the scrapers from System, and it works much faster, for instance to "exit" xbmc I needed with scraper activated 1-2 Minutes, without 5 seconds.
Reply
#9
You've not done the two most obvious things to see if there's a likely logical explanation.

1st checked in movie info of the scraped items to see what path it points to.
2nd enabled debug logging and started afresh to see why the scraper has done what it has done.

Most likely you've files in your movie media source that are not being correctly identified, so maybe incorrectly named movie files.
Reply
#10
Hello
I already did Number 1: I checked the Path, I checked and I deleted the MyVideo78.db and I set the Srapers anew on the path.
And also strange there were no additional movies on my Harddisk but I got in number more movies in the List, and in addition several month before the recognition all worked fine. Months ago the same files were recognized perfectly.

To Number 2: But how to enable debug mode ?
Reply
#11
(2014-12-21, 18:59)Jorgez Wrote: I work with Xbmc sine 2 year I never had someting like this, so I do not need to post anything.
And by the way I am not a rooky, I have studied Informatic sience and working in a big IT departent, and this is not the first case that I detected a Trojan.

After reading this all, I feel sorry for that big IT department!

You read about a lot of things like "there was a change in the search alogrythms of the scrapers" - I have no idea what does this mean btw, but you were not reading enough in the past 2 years to know how to enable debug logging and post it on the forum to let us see what is going on.

You don't even bother to say which scraper you are using. The Common Movie Scraper (which one btw?) what you naturally tried is actually a shared scraper library what is used by other scrapers - meaning you cannot use it standalone.

You are for sure not using a scraper from the official repo because it is simply not possible to get porn as content (data or images) with any of those.
Reply
#12
Hello Olympia

Please don't feel attacked, It took me long time to descide to post this, because it was clear every programmer would react like yours, impossible, but if no one follows the hint were a security hole could be once it will be to late.
Please let's be objective.

To your questions:
I read the change logs, and there I could read, that a new algorithm for better search was applied. (theMovieDb.org)

DebugMode: Thats a good one, but I never needed it before, that was the reason that I changed from Mediaportal to Xbmc on (Ubuntu 12.04 LT) it runs without any problems out of the box since 2 years. Also the Scrapers worked perfect these 2 Years.

The Scrapers I tried were Offical, Sorry I could not remember the exact name after deleting it. But I looked it up
Universal Movie Scraper (less problems)
theMovieDb.org

But more and more, I think the IMDB might be the Source of the Problems
Concerning the IMDB Address you should read that
https://www.robtex.net/en/advisory/ip/207/171/162/180/
IMDB is not only one Host !

May be that on of the IMDB server(s) has been compromized,
http://www.domain-ip.xyz/ip/207.171.162.180
Even Chinese claim the IP Adress their own.

What I recognized was that after I clearing the database (physically) and restarting the analysis sometimes the scraper receives 2 movie Metadata instead of one. This might be a hint. Everytimes this happened, I got one of this nasty movie enties.
Reply
#13
please stop the guessing game and post a Debug Log.
Do not PM or e-mail Team-Kodi members directly asking for support.
Always read the Forum rules, Kodi online-manual, FAQ, Help and Search the forum before posting.
Reply
#14
Hello Again

Sorry for the delay. Christmas Shopping
Here The Log file, I did not delete the password in the Log, but I changed it on my System later.
http://paste.ubuntu.com/9597117/
As I did a first glance I recogniced the following, after not finding the James Bond Movie "Der Mann mit dem goldenen Colt" a list of not physically existing Movies were returned. If you see the suggestions you will see what I mean.
Here you will find the list of the movies recorded via DVB-S in the directory the scraper is scanning.
http://paste.ubuntu.com/9597217/
Regards
Reply
#15
(2014-12-22, 18:50)Jorgez Wrote: As I did a first glance I recogniced the following, after not finding the James Bond Movie "Der Mann mit dem goldenen Colt" a list of not physically existing Movies were returned. If you see the suggestions you will see what I mean.

the scraper uses the filename, which is in your case 'James Bond 007 - Der Mann mit dem goldenen Colt -uv'
this will indeed result in inaccurate results:
http://www.themoviedb.org/search?query=J...n+Colt+-uv

if you strip the '-uv' part from the filename and you'll get an accurate result:
http://www.themoviedb.org/search?query=J...denen+Colt
Do not PM or e-mail Team-Kodi members directly asking for support.
Always read the Forum rules, Kodi online-manual, FAQ, Help and Search the forum before posting.
Reply

Logout Mark Read Team Forum Stats Members Help
Themoviedb.org and Movie Scraper acting like Trojans0