It’s a good video that is worth a watch, but what jumps out to me:
- There is a ton of security issues in the open source parts of software
- NanoKVM downloads a binary from wiki.spispeed.com instead of shipping it with the release. The binary is doing something with a custom Risk-V instruction and the kvm serial number.
- tcpdump and aircrack are installed (aircrack is a wifi hacking tool not useful for a KVM)
And a bonus youtube comment from the github contributor (@matejkovacic9382)
- The hardware includes a microphone, and NanoKVM ships with all Alsa tools
IMO, 1 can be attributed to Hanlon’s razor and hopefully will get fixed over time. 2 is probably a misguided attempt to make it possible to add licensing/DRM in the future. 3 & 4 are really hard to explain. To quote MatejKovacic’s comment:
“So to sum up - device is connecting to Chinese servers, has installed hacker/debugging tools (tcpdump and aircrack) and has buld-in microphone with all software support for recording.
Anyway, I am quite sure there is no big conspiracy here (just biiig negligence), but it really looks bad.”