Gaia Kodi Add-on

Question

https://kinkeadtech.com/gaia-kodi/

Another great article, just a few notations:

REGARDING THE MALWARE ISSUE

1.  I will admit that it is suspicious when Gaia developers would not address this issue on their web site, but they did remove the crypto miner after it was reported.  The same malware was also found in Bubbles, so it may not have been added by Gaia.

https://koditips.com/kodi-malware-bubbles-gaia/

2. I did some more research on this, and found that the malware was installed through a dependency used by other add-ons (see Settings / System / Add-ons / Manage dependencies)

https://www.cyberscoop.com/kodi-malware-cryptojacking-eset-bubbles-gaia/

3. I also found this malware on a Kodi box which never had Bubbles or Gaia installed.  In my tests, the TVA Indigo "no coin" scan did NOT detect this malware.  If you knew which repo first bumped the version number on SimpleJSON, you would be closer to finding the culprit.  According to the following article, the primary offending repo was XvBMC.

https://www.welivesecurity.com/2018/09/13/kodi-add-ons-launch-cryptomining-campaign/

4. Various third party Kodi builds and the Kodil (Kodi Israel) repo are notorious for hijacking and replacing common libraries & official Kodi add-ons, so these are some things you should watch for.

5. I am not yet convinced that Gaia was responsible for the malware, nor am I convinced that avoiding Gaia will prevent infections.  Gaia is an incredible add-on with an unprecedented amount of resources.  I will just have to monitor the situation more closely, keeping an eye on Kodi's CPU usage, file system activity, and network traffic.  Unfortunately Kodi does not make this as easy and convenient as it should be.

REGARDING GAIA USAGE

1. The Setup Wizard instructs you to visit the Alluc Web site, but the original Alluc site is down and Gaia does not show a URL for the site it wants us to use for the API key registration.  I know you addressed this already, but there must be some reason they left this feature in (such as an Alluc replacement).

2. Gaia says the Reaper setup option will give you less results.  If we choose this option, do we only miss the premium services -- or did we also lose some of the free providers?

3. Something has gone wrong with Gaia - its freezing on every search.  At the moment its basically unusable because I must reboot Kodi just to quit the app.

Nathan Kinkead · Answer

Thank you for providing your research, insight, and experience with Gaia.  I'm going to link the Gaia post to this forum topic so others learn from this.

I'm definitely willing to ease up on them about the crypto-mining issue, because it probably wasn't done by them on purpose.  However, my last experience with the Gaia add-on was very much like your very last point #3.  In addition to being the slowest add-on every to find and play a video, it was actually causing my Kodi to lock up and crash very frequently.  Once I managed to uninstall it, I haven't had a single lock-up or crash.