Hacked??
#1
Using Kodi on Amazon Fire TV.

Twice now, version 16.1 and now v17, I have been using Kodi and out of nowhere Teamviewer pops on the screen. I see characters being typed and then it disappears. I have never installed Teamviewer. Today, I saw a mouse cursor move across the screen. There is no mouse or keyboard attached to the Fire Tv.

Any thoughts?
Reply
#2
(2017-02-12, 05:12)bactex Wrote: Using Kodi on Amazon Fire TV.

Twice now, version 16.1 and now v17, I have been using Kodi and out of nowhere Teamviewer pops on the screen. I see characters being typed and then it disappears. I have never installed Teamviewer. Today, I saw a mouse cursor move across the screen. There is no mouse or keyboard attached to the Fire Tv.

Any thoughts?

What kodi 'build' are you using?
Reply
#3
Hi shomari,

I downloaded it today from the kodi website.

Android - Release ARM - kodi-17.0-Krypton-armeabi-v7a.apk.

Is that what you are asking for?

I am thinking of doing a factory reset of the fire tv. would you advise that?
Reply
#4
TeamViewer Hacks Make Virtual Possession a Thing

Sounds pretty similar to this article.
There is some dodgy Android App that is doing this installed. The obvious one to look for is any App to do with Virtual Private Networking, VPN's or a suspect File manager App.

Where was the FireTV purchased from ?

Ultimately you will very likely have to factory reset and wipe clean I suspect.

Reply
#5
You should definitely do a factory reset, but that's not guaranteed to solve the problem.

For your own peace of mind, as well as others reading this, official Kodi packages are 100% safe.

This issue is not Kodi related. Something else running on your system is to blame.
Reply
#6
Thanks very much to everyone for your advice. For the record, I trust Kodi. I just found it odd that I only ever noticed it with Kodi.

I did a factory reset. Now I need to figure out how Teamviewer is getting installed on the Fire Tv.

Cheers!
Reply
#7
Report back if you track it down pls.
I sorta recall someone else a while back had something similar going on with a FireTV.

I wonder if ES File Explorer is involved. Its Easily the Worst Malware, Adware, Spyware App on the Playstore at the moment.

Reply
#8
Your first post got me thinking. The box I bought from a major retail store so I am not too concerned about where it came from.

I have never installed ES File Explorer, but I did download a specific VPN (not sure if I can name it), both when I had v16.1 and with v17. I'll be happy to PM you with the VPN name if you'd like.
Reply
#9
No make it public and post here on the forums to warn others for future reference.

VPN's are not breaking forum rules if you just Post up a name.


Also while we are talking security...

Hands up everyone who thinks Hola Is Great ! because it is free right ?

Wrong ! You are joining one of the Biggest Botnets on the Planet !

Popular Chrome extension Hola sold users' bandwidth for botnets

https://8ch.net/hola.html

Reply
#10
(2017-02-12, 07:25)bactex Wrote: Your first post got me thinking. The box I bought from a major retail store so I am not too concerned about where it came from.

I have never installed ES File Explorer, but I did download a specific VPN (not sure if I can name it), both when I had v16.1 and with v17. I'll be happy to PM you with the VPN name if you'd like.

Make sure to check your security settings and ensure you haven't inadvertently granted administrator rights to a rogue app.

You may want to install 'disable service' if for nothing else than to get a quick itemized glance at what services are installed/running along with their associated packages, separated by system/downloaded categories. There are other ways to get that info but that's the quickest way to do it, within a clean ui, to boot.
Reply
#11
The app in question is PIA (Private Internet Access), but I want to make something clear. I do not think PIA is the issue. I think the website where I downloaded the app from is the issue (http://www.apkmirror.com). I had problems installing the APK from the PIA website, so I found the APK on the other webpage. This morning I went back to the PIA website and dowloaded the PIA apk from there and this time I was able to sideload it successfully on the Fire Tv.

So, if I am correct, this issue may come down to me just downloading what I thought was a trusted app from that particular website. At least I hope that's what it is.

Thanks everyone for your help.I'm installing Kodi again. If I see the behavior again (Teamviewer popping up), I'll report back.
Reply
#12
(2017-02-12, 16:38)bactex Wrote: The app in question is PIA (Private Internet Access), but I want to make something clear. I do not think PIA is the issue. I think the website where I downloaded the app from is the issue (http://www.apkmirror.com). I had problems installing the APK from the PIA website, so I found the APK on the other webpage. This morning I went back to the PIA website and dowloaded the PIA apk from there and this time I was able to sideload it successfully on the Fire Tv.

So, if I am correct, this issue may come down to me just downloading what I thought was a trusted app from that particular website. At least I hope that's what it is.

Thanks everyone for your help.I'm installing Kodi again. If I see the behavior again (Teamviewer popping up), I'll report back.

apkmirror is one of the most reputable sites for trusted apk sources. Not saying you're wrong, things happen, but I would find it odd if they were serving sheisty apks.
Reply
#13
@shomari

Thanks for the feedback on the apkmirror website. It helps me start ruling out possible culprits. I've started a log of what I have downloaded onto the Fire TV and from what source.
If this happens again, I'll be better prepared, hopefully, to find out what the culprit is.
Reply

Logout Mark Read Team Forum Stats Members Help
Hacked??0