Project

General

Profile

Forums » Tutorial and setups »

Unknown host subscribing to my TVHeadend via HTTP

Added by Simon Hanemaaijer almost 10 years ago

Hi all,

I've been wondering about this odd thing that has been happening for a while to my TVHeadend setup. From what i can see there is this foreign IP Connecting to my TvHeadend, or atleast TVheadend is somehow connected through that.

The following is visible to me:
Dec 01 20:04:20 OpenELEC tvheadend512: htsp: 192.168.178.13 [ XBMC Media Center ]: Disconnected
Dec 01 20:04:23 OpenELEC tvheadend512: mpegts: 162000 - tuning on DRXK DVB-C DVB-T : DVB-C #0
Dec 01 20:04:23 OpenELEC tvheadend512: subscription: "HTTP" subscribing on "BBC 1 HD", weight: 100, adapter: "DRXK DVB-C DVB-T : DVB-C #0", network: "Ziggo", mux: "162000", provider: "Ziggo", service: "BBC 1 HD"

As you can see after i quit watching something it automatically loads up BBC 1 HD. My first guess was that this is due to EPG grabbing etc, but if i remember correctly this is often shown in the debug.
Next when i navigate to the TVHeadend webinterface i see an unfamilair IP subscribed to this channel (BBC 1 HD). The IP is 5.103.214.131 which seems to be some Danish IP adress. Now i blocked all ports related to TVHeadend so i suppose that should make it harder to connect to it from the outside.

My guess is that i'm either being hacked or that its some weird subsystem in TVHeadend trying to idle around.... (which i find very weird too since it uses an unknown IP address.)

I hope anyone here can help me clarify this situation!


Replies (4)

RE: Unknown host subscribing to my TVHeadend via HTTP - Added by Gary Brown almost 10 years ago

is this computer connected directly to the internet?

RE: Unknown host subscribing to my TVHeadend via HTTP - Added by Mark Clarkstone almost 10 years ago

Well, I just looked at that IP and it appears to be running Apache and Tvheadend (which is ironically locked down (requires auth)).

I'm going to take a guess here and say that you'd left Tvheadend wide open and whoever is controlling that system is(was?) using yours to access the channels you have available.

There are numerous systems out there left wide open by default and they're not hard to find either.

RE: Unknown host subscribing to my TVHeadend via HTTP - Added by Simon Hanemaaijer almost 10 years ago

I supppse that is the situation indeed. Since i locked down the port there been no sighting of that odd connection. Is adding a login to tvheadend sufficiently secure to avoid things like this or would that offer no such protection?

RE: Unknown host subscribing to my TVHeadend via HTTP - Added by Mark Clarkstone almost 10 years ago

Simon Hanemaaijer wrote:

I supppse that is the situation indeed. Since i locked down the port there been no sighting of that odd connection. Is adding a login to tvheadend sufficiently secure to avoid things like this or would that offer no such protection?

Yes it would prevent unauthorised access as long as the credentials are decent. Just make sure you're running a newer revision though as there have been some access related fixes not long ago.

    (1-4/4)