pi-hole

I reckon this week's video on how Claude is tying together info from UniFi, Home Assistant and the Pi-Hole is an absolute ripper. Or at least the concept is - if ever there was an actual value proposition for AI it's taking lots of noise and converting it into a useful signal. Or, sometimes, it's just helping you see the woods through the trees, and that's exactly what Claude helped me do last night when every Sonos unit in the house refused to connect to any music service. It only took Claude a moment to work out: "you know your Pi-Hole is dead, right?" Uh... I do now! Give it a go, it's pretty awesome (and the Pi-Hole came good with a power cycle on the PoE port).

A researcher has reverse-engineered the iOS SDK that Bright Data embeds in consumer apps and documented how, with the user's consent, it can turn devices, including always-on smart TVs, into exit nodes that relay web-scraping traffic for a data business Bright Data markets heavily to the AI industry. The company, the successor to Luminati, operates what it calls the largest residential proxy network in the world, advertised at more than 400 million residential IPs. Part of that supply comes from this SDK, shipped inside free apps behind an opt-in screen and described by Bright Data as a consent-sourced pool of 150 million-plus IPs. The findings, published June 5 by Include Security and independent researcher Buchodi, matter because the scraping comes from the user's home IP, not the customer's. The immediate risk is not a hacked account or stolen data; it is that a home connection and its bandwidth get used as someone else's scraping infrastructure. A connected TV is close to ideal for that: usually plugged in, on a fast connection, effectively unmetered, and unwatched. The deepest technical evidence is from the iOS SDK; the smart-TV reach rests on Bright Data's platform support, its public partner list, and earlier reporting. The research found the peer channel that carries scraping jobs has no real authentication, and that on iOS, its traffic bypasses a configured VPN, which Bright Data says is an unintended bug it is fixing. Inside the peer tunnel When the app opens, the research found, the SDK fetches its instructions from a server that checks only the app's public ID and version, which means the same configuration can be pulled by anyone. From there, the server can direct the device to fetch pages from other websites, using the user's home internet connection to do it. The research found that the channel that carries those jobs has none of the usual security checks on who connects. On iPhones, the research found that this traffic slips past a configured VPN, and that the SDK is built in a way that keeps part of its activity out of view of some standard tools used to monitor apps. Bright Data says the VPN behavior is an unintended bug rather than a deliberate attempt to hide the SDK, that VPN traffic holds no value for its network, and that it is updating the software to detect an active VPN and stop routing around it. The research also found the device can keep relaying in the background while someone is watching the screen or on a call, as long as the battery is not low. The consent gap The research highlights a gap between how the opt-in screen describes the SDK and what its configuration permits. In Petflix, a Roku app, the screen tells users that Bright Data will "occasionally" use the device's free resources and IP address, and that no personal information is collected except the IP address. The SDK's configuration, the research found, sets a maximum of 200 GB of Wi-Fi traffic a month. (Petflix runs on Roku, which Bright Data says it no longer supports; the wording is set by the SDK, not the platform.) The research also found that in a few countries, including Uzbekistan and Oman, the configuration set far higher limits, with devices cleared to keep relaying almost until the battery ran flat. Bright Data says those were temporary legacy rules it has since removed. The research found Bright Data exposes its list of app partners on a page anyone can open, naming makers of smart-TV apps such as PlayWorks Digital, CloudTV, and Longvision. The researcher is careful to note that being on the list only shows a company worked with Bright Data at some point, not that its app includes the SDK today. Each one would need to be checked on its own. Bright Data disputes the characterization. In an email to The Hacker News, the company said its opt-in screen is explicit rather than buried in legal text, names Bright Data, links its privacy policy and license, and lets users opt out in two steps and keep using the app either way. It says the SDK reaches only approved domains, collects no personal data or browsing history, uses only the device's IP address, and runs on average around 50 MB a day on Wi-Fi, pausing when the device is busy or low on battery. The company's CEO, Or Lenchner, said a device in its network "is a device whose owner said yes, understood what they were saying yes to, and can say no again at any moment with two steps." Bright Data also points to independent audits and certifications, including a PwC report, AppEsteem certification, and ISO and SOC 2 attestations, published in its Trust Center. An old model, pulled by AI demand None of this is new in shape, only in scale. Bright Data is the successor to Luminati, the paid proxy service that grew out of Hola VPN. In 2015, Hola was caught selling its free users' bandwidth as exit nodes through Luminati, at $20 a gigabyte. The same business model now runs on the always-on box in the living room, though Bright Data says today's SDK is opt-in and independently audited in ways the 2015 setup was not. What changed is the buyer. Anti-bot defenses from Cloudflare, DataDome, and others block scrapers coming from datacenter IPs, so AI scrapers route through residential connections instead. Krebs reported in October 2025 that proxies from botnets like Aisuru are fueling large-scale AI data harvesting, and Google dismantled the criminal IPIDEA proxy network in January. Those operations hijack consumer devices; Bright Data says its exit nodes opt in through a consent screen. That consent is the line between the two, and whether it is meaningful is an open question. Lowpass, syndicated by The Verge, first surfaced the smart-TV angle in February, and this is the technical teardown. Google, Amazon, and Roku have since restricted background proxy SDKs, and Bright Data dropped those platforms, though it still lists Samsung's Tizen and LG's webOS. What to do The traffic is easy to spot and block. On a home network, the simplest step is to block the web addresses the SDK uses to connect, with a router-level tool like Pi-hole or NextDNS. The main ones are proxyjs.brdtnet.com, proxyjs.luminatinet.com, proxyjs.bright-sdk.com, clientsdk.bright-sdk.com, and clientsdk.brdtnet.com. According to the research, blocking these stops the device from acting as a relay without affecting Bright Data's paid service, which runs on separate addresses. Companies that manage staff phones can also scan for apps that carry the SDK. One catch: on a mobile connection, the traffic sidesteps office Wi-Fi, so a network block alone will not always catch it. Bright Data could also change how the SDK connects in the future, which would mean any blocklist needs updating. Updated on June 9 and June 16, 2026, to include Bright Data's response and a comment from its CEO, and to reflect later revisions to the source research.

For the latest discoveries in cyber research for the week of 4th August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Russia’s largest airline Aeroflot has been attacked by pro-Ukrainian hacktivist groups, resulting in severe flight delays and major technical disruptions. The attackers claim to have exfiltrated databases containing flight history, workstation data, phone call recordings, and personnel monitoring information, allegedly wiping 7,000 servers totaling over 22TB of data. French telecommunications giant Orange has experienced a cyber attack that resulted in operational disruptions, primarily affecting French customers and certain business and consumer services. No evidence of exfiltration of customer or company data has been found, and the extent of compromised data remains unclear at this stage. The City of Saint Paul in Minnesota, US, has experienced a cyber attack that resulted in widespread disruptions to its digital services and critical municipal systems, including the unavailability of online payments and temporary outages in libraries and recreation centers. While emergency services were not affected, 311,000 residents experienced delays or interruptions in accessing city resources. Pi-hole, a popular network-level ad-blocker, has suffered a data breach that resulted in the exposure of donor names and email addresses due to security vulnerability in the GiveWP WordPress donation plugin. The incident impacted nearly 30,000 donors. Seychelles Commercial Bank has suffered a data breach that resulted in the exposure of 2.2GB of sensitive customer information, including personal data such as names, dates of birth, phone numbers, account types, balances, and records linked to government officials. The attack impacted both individual and business accounts, along with staff data. Russian pharmacy chains Stolichki and Neofarm have confirmed a cyberattack that resulted in hundreds of branch closures and disruption of payment systems, drug reservations, and customer loyalty programs, affecting access of thousands of patients to medication across Russia. Dating safety application Tea has experienced a data breach that resulted in the exposure of over 59 GB of sensitive user data, including approximately 72,000 images such as selfies, government IDs, and photos posted in the application, as well as a separate database containing 1.1 million private messages exchanged between members. The French National Museum of Natural History has confirmed a cyberattack that resulted in a significant disruption of its internal and collaborative research systems. The attack affected access to scientific databases and ongoing research, particularly impacting international projects and collaborations. VULNERABILITIES AND PATCHES Researchers discovered a critical vulnerability in the AI-powered development platform Base44 that allowed unauthenticated access to private applications by abusing exposed endpoints. The flaw stemmed from improperly secured API which accepted arbitrary app_id values without requiring credentials or SSO verification. Successful exploitation could grant attackers unauthorized access to sensitive enterprise tools handling HR data, internal systems, or PII. Researchers have released a technical analysis of three critical vulnerabilities in SonicWall SMA100 series devices: CVE-2025-40596, CVE-2025-40597, and CVE-2025-40598. The flaws include a stack buffer overflow, a heap overflow, and an arbitrary memory write, all triggerable via unauthenticated HTTP POST requests to a CGI endpoint. Successful exploitation may lead to remote code execution with root privileges. Check point IPS provides protection against these threats (SonicWall SMA100 Stack Overflow) Enable Security identified a critical vulnerability (CVE-2025-53399) in the ngcp-rtpengine software that allows unauthenticated remote code execution via crafted WebSocket messages. The issue stems from a type confusion in processing control protocol messages, enabling attackers to overwrite function pointers and hijack execution flow. Exploitation results in full control over the rtpengine process, with a public proof-of-concept available. THREAT INTELLIGENCE REPORTS Check Point Research released a comprehensive analysis of Q2 2025 ransomware trends, highlighting ecosystem fragmentation after several Ransomware-as-a-Service groups disruption, the operational use of AI as part of ransomware operations, and the emergence of cartel models such as DragonForce. Qilin ransomware was the leader in Q2 with new extortion tools and legal services, while groups like Global Group offered AI-powered negotiation as a RaaS feature. Payment rates dropped globally due to increased distrust in attackers and policy pressure, but ransom groups now focus more on data extortion and innovative reputation attacks. Check Point Research conducted a focused analysis of Storm-2603, one of the threat actors associated with recent ToolShell exploitations, which likely targeted organizations in Latin America throughout the first half of 2025, in parallel to attacking organizations in APAC. Storm-2603 utilizes a custom malware Command and Control framework dubbed internally by the attacker as “ak47c2” which includes HTTP-based and DNS-based clients. Check Point Research have uncovered a new malicious campaign dubbed “JSCEAL”, targeting crypto applications users by leveraging malicious advertisements. The campaign uses fake applications impersonating popular cryptocurrency trading apps, with over 35,000 malicious ads served in the first half of 2025, generating millions of impressions in the EU alone. JSCEAL malware, which is delivered through sophisticated multi-layered infection flows, steals cryptocurrency-related data like credentials and wallets, making it a significant threat to crypto applications users.

Pi-hole, a popular network-level ad-blocker, has disclosed that donor names and email addresses were exposed through a security vulnerability in the GiveWP WordPress donation plugin. Pi-hole acts as a DNS sinkhole, filtering out unwanted content before it reaches the users' devices. While initially designed to run on Raspberry Pi single-board computers, it now supports various Linux systems on dedicated hardware or virtual machines. The organization stated that they first learned of the incident on Monday, July 28, after donors began reporting that they were receiving suspicious emails at addresses used exclusively for donations. As explained in a Friday post-mortem, the breach affected users who donated through the Pi-hole website's donation form to support development, exposing personal information that was visible to anyone who viewed the webpage's source code due to a GiveWP security flaw. The vulnerability stemmed from GiveWP, a WordPress plugin used to process donations on the Pi-hole website. The plugin inadvertently made donor information publicly accessible without requiring authentication or special access privileges. While Pi-hole didn't disclose the number of affected customers, the 'Have I Been Pwned' data breach notification service added the Pi-hole breach, saying that it impacted almost 30,000 donors, with 73% of the exposed records already in its database. No financial information exposed Pi-hole added that no donor financial data was compromised, as credit card information and other payment details are handled directly by Stripe and PayPal. It also clarified that the Pi-hole software product itself was not affected in any way. "We make it clear in the donation form that we don't even require a valid name or email address, it's purely for users to see and manage their donations," Pi-hole said. "It is also important to note that Pi-hole the product is categorically not the subject of this breach. There is no action needed from users with a Pi-hole installed on their network." Although GiveWP released a patch within hours of the vulnerability being reported on GitHub, Pi-hole criticized the plugin developer's response, citing a 17.5-hour delay before notifying users and what it described as insufficient acknowledgment of the security flaw's potential impact on donor names and email addresses. Pi-hole apologized to affected donors and acknowledged potential reputation damage stemming from this security incident, saying that while the vulnerability was unforeseeable, they accept accountability for the resulting data breach. "The names and email addresses of anyone that had ever donated via our donation page was there for the entire world to see (provided they were savvy enough to right click->View page source). Within a couple of hours of this report, they had patched the bad code and released 4.6.1," Pi-hole added in a blog post analyzing the incident. "We take full responsibility for the software we deploy. We placed our trust in a widely-used plugin, and that trust was broken." Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report