Entware Pi-hole directly on the router? Yes!

[bibikalka]

Obvious question is how did malware/trojan get onto the Amazon Firestick? Was it through an installed app (if so which one) or through some other method? If you have one infected device on the local network, are there others?

Yes, I tracked down the specific malware apk. It installed itself somehow on the idle stick. I am thinking maybe some shady streaming app did that. Turned it off for the next few days, may resume later.

As with any addon script, there is no guarantee it won't crash or have adverse affects. You are running Pi-Hole that wasn't, as I understand it, installed using an official Pi-Hole installation package on a device (router) running third party firmware (Asus-Merlin) that wasn't officially (by Asus) designed to run Pi-Hole or other addon scripts. While Pi-Hole may operate in such a setup you may experience unexpected behaviors. In this case an infected device may have triggered, lead too, or contributed to, a Pi-Hole crash.

This PiHole implementation has been very robust for me in this configuration. So everything was as expected - until this latest combo of the malware and the new version. Maybe older versions would have crashed too - who knows ...

 

[visortgw]

Yes, I tracked down the specific malware apk. It installed itself somehow on the idle stick. I am thinking maybe some shady streaming app did that. Turned it off for the next few days, may resume later.

This PiHole implementation has been very robust for me in this configuration. So everything was as expected - until this latest combo of the malware and the new version. Maybe older versions would have crashed too - who knows ...

Any clue as to which streaming app may be the culprit?

 

[bennor]

Yes, I tracked down the specific malware apk. It installed itself somehow on the idle stick. I am thinking maybe some shady streaming app did that. Turned it off for the next few days, may resume later.

Might the streaming app have been SmartTube?
That popular YouTube alternative on Android TV was secretly distributing infected builds

 

[bibikalka]

Might the streaming app have been SmartTube?
That popular YouTube alternative on Android TV was secretly distributing infected builds

It is totally possible! I do run it a bunch of those.

I just reinstalled on all of them, most were below 30.56, I think some were much older. But I guess this one slipped through on a stick.

I also have my TCL TV mysteriously asking for adb access from a device I don't recognize. I have not been able to fully track that down, but the version there was updated in early Feb. So I'll pay attention of the message shows up again.