Kaspersky and spying for Russian Federation


Recommended Posts

8 minutes ago, adrynalyne said:

Your lack of ability to provide evidence is what contributes to it. Your lack of knowledge of ip geolocation and how inaccurate it can be contributes to it. 

 

i think it is true in any language--if you make a bold claim, back it up. You are not doing that here. 

I've provided enough facts and evidence for user to test it. You are just not accepting provided data as an evidence and refusing to check it by yourself.

2 minutes ago, AndyMutz said:

i just tried this and i have no traces of any kaspersky entries in that log.

i have been using kaspersky for years, but i am not using every protection it offers, e.g. i always disable the browser addon and i also deactivate the URL and HTTPS scan options.

 

 -andy-

You have to use "Internet Explorer", enable Kaspersky addon and press F12 inside the web browser to see if browser tries to make requests to ie.kis.scr.kaspersky-labs.com.

 

5 minutes ago, EJocys said:

I've provided enough facts and evidence for user to test it. You are just not accepting provided data as an evidence and refusing to check it by yourself.

I didnt make the claim, you did. You have yet to tell me what sensitive information was sent. You are purposely dodging the question. Why should I pollute my machine with an AV I would never use for me to prove to myself a claim someone else made? If I was making the claim and told you the same, you would not do so either. 

 

Just provide evidence of senstive information being sent and we can be done with this. It only serves to make you look ridiculous by dancing around the issue. 

10 minutes ago, adrynalyne said:

I didnt make the claim, you did. You have yet to tell me what sensitive information was sent. You are purposely dodging the question. Why should I pollute my machine with an AV I would never use for me to prove to myself a claim someone else made? If I was making the claim and told you the same, you would not do so either. 

 

Just provide evidence of senstive information being on being sent and we can be done with this. It only serves to make you look ridiculous by dancing around the issue. 

Browser debug tools clearly shows that data was not only sent but response was received and I could see results (Script and JASON data). I proved my original claim - browser tried to make request to URL which has external address with geolocation in Moscow. Then, you asked me to prove something which I did not claimed i.e. that request reached remote server. I have no intention to prove this extra claim, because I removed Kaspersky from all my PCs and have no intention to reinstall it. For this reason I've asked users to test (gather evidence) themselves.

 

You could be more precise-specific with your answers. Pointing directly to, where I am wrong, would be more constructive in this discussion, than abstract statement, that I don't know something about network and security.

 

 

11 minutes ago, EJocys said:

Browser debug tools clearly shows that data was not only sent but response was received and I could see results (Script and JASON data). I proved my original claim - browser tried to make request to URL which has external address with geolocation in Moscow. Then, you asked me to prove something which I did not claimed i.e. that request reached remote server. I have no intention to prove this extra claim, because I removed Kaspersky from all my PCs and have no intention to reinstall it. For this reason I've asked users to test (gather evidence) themselves.

 

You could be more precise-specific with your answers. Pointing directly to, where I am wrong, would be more constructive in this discussion, than abstract statement, that I don't know something about network and security.

 

 

Did you not post this?

 

or example: Every time I was using secure search on google.co.uk, Kaspersky would make connections to server in Russia and load JavaScript which in itself enables

ability to send all my logins, passwords and other sensitive data to file providers, because it was running from inside a secure connection and all sensitive data was available in plain text:

 

I want to see evidence of what is highlighted. Your links don't work. I don't know why you thought they would.

31 minutes ago, adrynalyne said:

Did you not post this?

 

 

 

 

I want to see evidence of what is highlighted. Your links don't work. I don't know why you thought they would.

See. We don't agree even on what sensitive data is. I think that information about bank (clearly supplied in URL), I hold my accounts in, is sensitive data, because it allows more precise targeting for hackers. Since requests to external URL include not only bank host name, but path and query (GET data) this means that much more than just bank name is sent to third party.

It doe not end here. Web browser gets reply as a JavaScript and this opens possibilities to request any data from the page on demand. I used that method myself to override functions on remote clients, it was legal because my code was not coming from third party and was used to fix broken functions I could not deploy onto to remote client. I knew what I could do with my "workaround" and how to bypass cross-domain restriction when submitting data to third parties and this is exactly why I don't feel comfortable when Kaspersky is using similar method.

 

> Your links don't work. I don't know why you thought they would.

 

These links return data to browser only when Kaspersky add-on handles them, which is perfectly expected. It is up to Kaspersky to refresh them and decide who gets cashed content and who get updated version directly or indirectly from the Internet.

 

Edited by EJocys
20 minutes ago, EJocys said:

See. We don't agree even on what sensitive data is. I think that information about bank (clearly supplied in URL), I hold my accounts in, is sensitive data, because it allows more precise targeting for hackers. Since requests to external URL include not only bank host name, but path and query (GET data) this means that much more than just bank name is sent to third party.

It doe not end here. Web browser gets reply as a JavaScript and this opens possibilities to request any data from the page on demand. I used that method myself to override functions on remote clients, it was legal because my code was not coming from third party and was used to fix broken functions I could not deploy onto to remote client. I knew what I could do with my "workaround" and how to bypass cross-domain restriction when submitting data to third parties and this is exactly why I don't feel comfortable when Kaspersky is using similar method.

 

> Your links don't work. I don't know why you thought they would.

 

These links return data to browser only when Kaspersky add-on handles them, which is perfectly expected. It is up to Kaspersky to refresh them and decide who gets cashed content and who get updated version directly or indirectly from the Internet.

 

If that was sensitive to you, then I don't know what to tell you. Thousands (more?) use that same URL...

39 minutes ago, EJocys said:

Amount of users does not make information non-sensitive. Pornhub users would agree. :)

It isn't sensitive nor private if everyone uses it. 

 

Do you feel the same about Google.com? It isn't any different. 

39 minutes ago, adrynalyne said:

It isn't sensitive nor private if everyone uses it. 

 

Do you feel the same about Google.com? It isn't any different. 

Sensitivity of data doesn't depend on popularity of the website. There is a difference between information that you are visiting google and information on what you are looking for. If person is nobody, then he is safe, because nobody gives a ###### what he is doing, but information gives ability to use blackmail if it is private and person holds some decision power. For example person from the government who is using online cheating or some other kinky site, person who is looking at his medical records, or gay politician who is visiting gay sites and lives in a country with strict sharia laws. There are sites which use URL query to pass private data when using HTTPS, especially web sites with REST design. Also to note: You managed to ignore important part that, that URL to Kaspersky included not just domain name but full path.

 

P.S.: I must admit that system, designed by Kaspersky is actually brilliant, because if Kaspersky allows browser to make full request then Russian Secret services can enable spying and hacking on any client of their choosing. This system potentially allows to kill and infect all Kapsersky protected PCs in a single move if cyber attack by government is necessary. Why? because, according to web browser debug logs, every web browser "protected" by Kaspersky tries to get out and call the mothership. And you can't just refuse to visit some "infected" site, because browser tries to make this call for every site.

2 minutes ago, EJocys said:

Sensitivity of data doesn't depend on popularity of the website. There is a difference between information that you are visiting google and information on what you are looking for. If person is nobody, then he is safe, because nobody gives a ###### what he is doing, but information gives ability to use blackmail if it is private and person holds some decision power. For example person from the government who is using online cheating or some other kinky site, person who is looking at his medical records, or gay politician who is visiting gay sites and lives in a country with strict sharia laws. There are sites which use URL query to pass private data when using HTTPS, especially web sites with REST design. Also to note: You managed to ignore important part that, that URL to Kaspersky included not just domain name but full path.

 

P.S.: I must admit that system, designed by Kaspersky is actually brilliant, because if Kaspersky allows browser to make full request then Russian Secret services can enable spying and hacking on any client of their choosing. This system potentially allows to kill and infect all Kapsersky protected PCs in a single move if cyber attack by government is necessary. Why? because, according to web browser debug logs, every web browser "protected" by Kaspersky tries to get out and call the mothership. And you can't just refuse to visit some "infected" site, because browser tries to make this call for every site.

I'm done. Your PS statement is absolutely ridiculous. 

17 minutes ago, adrynalyne said:

I'm done. Your PS statement is absolutely ridiculous. 

Which part is ridiculous exactly? Because everything is supported by evidence. Please explain why Kaspersky choose to force browser to make request to domain name which points to external source on the internet when 127.0.0.1 would be fine and much more secure? Do you think that they made this mistake because they are stupid? Maybe you need a reality check and realize that Russia is under sanctions, because their government is not known for their moral behaviour. It is not ridiculous, it would be perfectly normal behaviour for a country which fights hybrid wars with other countries and constantly lies on TV channels owned by the government.

Edited by EJocys
12 hours ago, EJocys said:

So, if you have Kaspersky on your computer, then please open secure site like https://www.google.com, press F12 for debug mode, go into “Network” tab, refresh page, see for yourself and report your opinion.

 

Thank you.

Funny, I have Kaspersky Total Security and just did as you requested, and the only traffic that shows is to Google, nothing else, just Google.

Capture.PNG

9 minutes ago, EJocys said:

Which part is ridiculous exactly? Because everything is supported by evidence. Please explain why Kaspersky choose to force browser to make request to domain name which points to external source on the internet when 127.0.0.1 would be fine and much more secure? Do you think that they made this mistake because they are stupid? Maybe you need a reality check and realize that Russia is under sanctions, because their government is not known for their moral behaviour.

I have met Kaspersky, and his employees... By random chance.

 

At computing meetings in Russia.. In airplane, sitting next to them....

 

And i know i would not trust them.

 

I would not touch that antivirus with a 10 foot pole. 

 

If it is not the government... They are selling all your info to the highest bidder. That is a fact.

 

 

Hello,

 

Perhaps the following would be of interest:

 

Quote

Kaspersky Lab would like to explain the injection of special script in web pages loaded in users’ browsers. This technology is going to replace the obsolete plugin technology in our consumer products launched or updated in 2015 and later on. The new protection technology adds a special script to a web page shown to the user, which does not send any data from the computer to third-party servers but works as a communication channel between the browser and our security solution. This interaction is performed in the form of sending requests to a special technical URL, which the browser interprets as addressing a remote server, however, instead of the remote server these special requests are handled by security solution, running locally. This means that no information leaves the computer via this script.


This technology is used by several components of Kaspersky Lab solutions for home users, including web antivirus, anti-phishing and Safe Money. As this technology was designed solely for the purpose of providing better protection, our products currently do not offer an option of disabling this script. However, our experts are currently working on modifications to the company’s solutions that will enable users to disable the script if they desire. This change may be included in forthcoming updates.

 

Source:  f.kis.scr, main.js javascript injection issue with Firefox, [merged with same]  (Kaspersky Lab Forum)

 

So, it looks like it is a normal part of their software.

 

Regards,

 

Aryeh Goretsky

 

 

 

  • Like 2
6 hours ago, goretsky said:

Hello,

 

Perhaps the following would be of interest:

 

 

Source:  f.kis.scr, main.js javascript injection issue with Firefox, [merged with same]  (Kaspersky Lab Forum)

 

So, it looks like it is a normal part of their software.

 

Regards,

 

Aryeh Goretsky

 

 

 

That was very informative. Thank you.

 

Kaspersky claims that "requests are handled by security solution, running locally", but they do not explain why they decided to use live domains for local solution. If "security solution" was not intercepting then requests would go directly to their servers on The Internet. In the context, sentence "technology was designed solely for the purpose of providing better protection" sounds a little bit like "we are spying on you for your own protection" :).

 

P.S.: This reminded me to check if they conveniently forgot to remove something, after I uninstalled Kaspersky Anti-Virus. Antivirus scans content of HTTPS web sites by creating tunnel and having full access in unencrypted form, which is normal practice for firewalls. In order for web browser not display security warnings, Kaspersky installs security certificate into "Trusted Root Certification Authorities". Launched "certmgr.msc" and here it is - forgotten "Kaspersky Anti-Virus Personal Root Certificate". Removed.

Hello,

 

No idea about the decision to use live domains.  I would imagine there is some logical reason for this, though.  I've met a number of their researchers over the years and they're pretty sharp.

 

Decrypting encrypted streams to scan them is pretty standard behavior for anti-malware software these days.

 

Regards,

 

Aryeh Goretsky

 

@OP

...and Windows 10 is sending all your data to US Federation. .... Drumroll !!

 

Doesn't matter. Your personal data is always going to end up at either side of the world the moment you plug that LAN cable or join wifi. Don't worry. Your data would be safe there :)

 

If you are really paranoid, back up and save that data to Baidu cloud too just to be safe.

1 hour ago, goretsky said:

Hello,

 

No idea about the decision to use live domains.  I would imagine there is some logical reason for this, though.  I've met a number of their researchers over the years and they're pretty sharp.

 

Decrypting encrypted streams to scan them is pretty standard behavior for anti-malware software these days.

 

Regards,

 

Aryeh Goretsky

 

I agree that they are pretty sharp and I liked their product in general.

 

My tin-foil side thinks that script injection was created as a workaround to solve the legal issue i.e. to be able to make an official claim that Kaspersky is not sending customers data to Kaspersky servers. Technically they are correct. It is the browser, which is trying to send data to Kaspersky servers. Kaspersky antivirus is just giving ze orders :). Live domain means that Kaspersky use rules, which are responsible to identify which domains can pass through and which will be blocked. My wild guess would be that there is a way to edit these rules without recompiling the code. This would make product compatible with the countries where law requires access to tracking by the government.


People are forgetting that anti-virus software plays major role in cyber warfare. It is like missile defence system but against viruses and hacking. It would be naïve to think that governments are not interested in affecting antivirus products in order for it to give strategic advantage, especially knowing the fact that CEO of Kaspersky was educated in KGB sponsored facility and worked with FSB.

On 8/21/2016 at 2:01 PM, EJocys said:

You don't understand the problem. Problem is that Kesperky injects scripts into encrypted content and browser tries to post data to external servers on the internet.

You dont undestand an a idea. 

 

If you visiting www.Santander-bank.com it will say STOP, instead of original santanderbank.com

 

And it checking ANY JS scripts of any hosts to worry you if host been hacked. As again STOP you paranoia and disable kaspersky at network setting if you dont like it.

http://support.kaspersky.com/us/9007#block2

12092_0413-274390.png

conflittorete.jpg

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • ZimaBoard 2 1664 Starter Kit review: it's a cool and affordable DIY NAS by Steven Parker IceWhale Technology reached out to me asking if I was interested in testing the ZimaBoard 2, and after convincing them to send me the Starter Kit, it arrived at my doorstep in May. A bit of background: it is a Shanghai-based Chinese company founded in 2020, which specializes in single-board servers and personal cloud solutions. From searching around online, user feedback on the company and ZimaOS is mostly positive, so we're off to a good start. In addition, I should probably point out that although they do not have a large portfolio of NAS devices, with just four of what they do offer, they seem to have covered everything from a relatively low-priced entry point with the ZimaBoard 2, right up to the high end, with the ZimaCube 2 Creator Pack that even includes an NVIDIA RTX PRO 2000. Anyway, as already mentioned, what we have today is the ZimaBoard 2 Starter Kit, and here are the full specifications: ZimaBoard 2 Model 832, 1664 CPU Intel Core N150 (4x E Cores/Threads, Max burst up to 3.6 GHz) TDP: 6W (Base) 10W (Max) Graphics Intel UHD Graphics 24 EUs (1.00 GHz) Memory 8 GB, 16 GB DDR5 4800MT/s non ECC SODIMM (soldered) Disk Capacity 60 TB (30 TB x 2) Supported RAID Types TRAID, TRAID +, RAID0, RAID1, RAID5, RAID 6, RAID 10 Storage 2 x SATA 3.0 6Gb/s Ports with Power Bootloader 32 GB, 64 GB eMMC Network 2x RJ-45 2.5 GbE PCIe 1 x PCIe 3.0 (via LPC) USB Ports 2 x USB-A 3.1 (5 Gbps) Display Mini-DisplayPort 1.4 (4K@60Hz) Hardware Transcoding Engine H.264, H.265, MPEG-4, VC-1 Maximum resolution: 4K (4096 x 2160); Maximum FPS: 60 Virtualization Intel® AES New Instructions Intel® Virtualization Technology (VT-x) Intel® Virtualization Technology for Directed I/O (VT-d) Size (H/W/D) 140mm x 83mm x 31mm Weight 0.4 kg (only ZimaBoard 2 device) Power 12v 5A Power Supply Warranty 1 year (Global) 2 Years (EU) OS ZimaOS v1.6.1 MSRP $339, $399 ($548.60) As you can see above, there are two variants of the ZimaBoard 2. The lesser variant has half the eMMC storage and 8 GB less RAM, although it also costs $60 less than the top variant we are testing today. The above pricing is only for the ZimaBoard 2. I put the MSRP of the Starter Kit next to it in brackets, although as of publishing, it is discounted to $534.50. The ZimaBoard 2 started life on Kickstarter and shipped to backers in August last year. It became available via the official website in late 2025 and Q1 2026. This hobbyist NAS contains the still relatively new N150 Intel CPU released in the first quarter of 2025, with support for DisplayPort 1.4, HDMI 2.1, although in this case, the memory is integrated into the board itself, so it will not be possible to upgrade or expand the amount. It also supports AV1 decoding, as well as H.264, VP8, VP9, H.265 (8 bit), and H.265 (10 bit). The different capabilities in the Alder Lake-N (and Twin Lake) series are listed below. Processor E-cores L3-cache Turbo clock GPU GPU-clock TDP Intel N355 8 6 MB 3.9 GHz 32 EUs 1.35 GHz 9 W Intel Core 3 N350 3.9 GHz 1.35 GHz 7 W Intel Core i3-N305 3.8 GHz 1.25 GHz 9 W Intel Core i3-N300 3.8 GHz 1.25 GHz Intel N250 4 3.8 GHz 1.25 GHz 6 W Intel Processor N200 3.7 GHz 0.75 GHz Intel N150 3.6 GHz 24 EUs 1 GHz Intel N97 1.2 GHz 12 W Intel Processor N100 3.4 GHz 0.75 GHz 6 W The CPU is part of the Twin Lake series that sits near the bottom of the N-series, designed for low- powered systems and entry-level laptops, and as such has a base level TDP of just 6W. As I have noted before, we are seeing another NAS with a great amount of RAM. It's important to mention that the ZimaBoard 2's memory is integrated into the base board (which is why they have two variants of it). As a reminder, up until a couple of years ago, it was commonplace to only get 2 or 4GB max on a flagship Synology or QNAP home NAS. Ever since the likes of TerraMaster and more have entered the market with ample RAM sizes included in their NAS offerings, it has gone a long way in forcing the hands of the traditional makers to up their game a bit. First impressions The Starter Kit came in one outer box with several packages inside it (shown above). I forgot to take pics of it because when it arrived, it wasn't clear what was inside, and I had to confirm with my contact that I received the entire Starter Kit. In the box ZimaBoard 2 ZimaBoard 2 HDD Expansion Bracket + PCIe card frame Zimaboard Mini DisplayPort Male to HDMI Female Cable 4K 60Hz Zimaboard PCIe 3.0 x4 to Dual NVMe M.2 SSD Adapter Card Quick guide [full online guide] Limited warranty notice Screws Design Where to start? You'd be forgiven for mistaking it as an SSD enclosure if not for all the ports on it. It is completely made out of metal, and the top is an entire heatsink. It has a premium feel about it, but it definitely looks like a hobby device. As you will see, the completed build looks like it belongs in a server or meter closet rather than as a showpiece on someone's desk. On what I am calling the rear, there's a Mini DisplayPort (1.4), two 2.5 GbE ports, with Type A 3.1 USB ports, and then the barrel connector port. Around the front, there are two SATA6 ports with a power connector in the middle. Left side Right side One side is completely free of ports. On the other there's a slit that allows for the feed of a CPU fan cable, and a PCIe 3.0 X4 slot. Top Bottom The top is entirely made up of a heatsink except for the extended height for the I/O on the rear. Around the other side, you can find the ZIMA branding and some regulatory information stamped near the bottom. As you may see from the bottom of the ZimaBoard 2, it scratches quite easily from just moving it around on my Ikea island. Teardown Before we get started, let's have a look at this thing on the inside. The steps to get to the board are as follows: Remove the four smaller Torx screws on the bottom of the ZimaBoard 2; Remove the four larger Torx screws on the sides of the device; Carefully unstick the CMOS battery from the PCB; Remove two Phillips screws on the PCB; Lift out the PCB. Yes, as you can tell from the instructions, you need three different tools to remove Torx and Phillips screws (10 in total), and unhelpfully, one of the screws is located under the CMOS battery, which is stuck onto the PCB. Building Now comes the fun part. Because the ZimaSpace website does not provide any guidance on how to put the Starter Kit together. They only have guidance for connecting the CPU fan. However, they did upload a video to their YouTube channel that shows the entire process. To install the fan, first remove the four screws on the bottom of the ZimaBoard 2, then on the inside, there is a CPU FAN connector where you can attach the fan, reattach the ZimaBoard 2 frame, and feed the fan cable through the provided slit. Then remove the nearest screw on the side and attach the fan frame to the side of the device using the same screw. ZimaBard 2 screws Aligning the screws Bottom view Remember those four screws we removed to access the CPU FAN? Longer screws are provided in the box with the HDD Expansion Bracket, which is what you will now need to attach the ZimaBoard 2 to it. Helpfully, the orientation on how to attach it is made obvious when the frame can only be screwed on at the same overall length as the ZimaBoard 2. If you do it the wrong way around (which is what I did initially) one side hangs off the frame, and it becomes difficult to attach the PCIe Adapter Card cable. PCIe card frame Other side PCIe slot connector Next, it's time to attach the PCIe card frame, which is fastened with the help of 3.5-inch SATA HDD (3 screws). These are toolless screws that you can just use your fingers to fasten them with. Then it is time to connect the provided PCIe cable with the slot connector on one side of the ZimaBoard 2, feed it through the bottom of the HDD frame, and fasten it with two standoffs. Both bracket options 2280 standoffs with 2x 4TB MP44Q The PCIe 3.0 X4 card comes with a short bracket option, handy if you decide to place it inside a different NAS or rack server, but here we need the long bracket. Oddly enough, the M.2 standoffs were preinstalled into the 22110 position, but extra standoffs are included in the box, which I installed at the 2280 position for our use. I added a couple of MP44Q M.2 PCIe 4.0 SSDs (2 x 4TB) that can be availed on Amazon for $478.99 (the lowest price for 3 months) that TEAMGROUP supplied us with Then we have the almost completed build, you just need to push the card into the PCIe slot. Unfortunately, IceWhale Technologies did not provide a screw for the PCIe card frame (this is also apparent in their own video). Here it is at several different angles, with the last pic showing the SATA Y-Cable connected to the two WD Red Plus 4TB drives. Setup and Usage Next, you connect your cables to the I/O, and the ZimaBoard 2 powers on automatically, as there is no power button on the device. Power is controlled through the Settings in ZimaOS. BIOS The ZimaBoard 2 includes an Aptio BIOS from American Megatrends [1, 2, 3], and you can setup pretty much everything here including the boot order, which is locked to the UEFI OS, however above that choice you can enable or disable booting to a SATA/USB bootloader so this would still allow you to switch to an alternative bootloader and boot from it, or disable it to instead always start from the first disk with an OS installed on it. Initial Setup Upon connecting to the LAN and booting up, the ZimaBoard 2 can be reached by navigating to the IP address (shown if you have a monitor connected), or you can find it using the ZIMA Client desktop application, which is essentially a Zima device finder. Initializing the ZimaBoard 2 The ZimaOS setup process is pretty straightforward, through a wizard, and in full above, it basically consists of setting up an account and some handy tips, and that's that! Post Setup (ZimaOS update) Upon first boot, you are alerted that there is a ZimaOS update from 1.5.0 to 1.6.1, which I applied; the full process is shown above with the changelog. ZimaBoard 2 Storage Setup Next, it is time to set up the storage. ZimaOS actually throws everything onto the eMMC flash drive; it is also the default location of AppData, which is definitely something to be wary about, as the 45GB available storage could fill up quickly. HDDs I first attempted to create a Storage Pool using the two 4TB WD Red Plus NAS drives, and got an error message: After several attempts and then looking online, I discovered it was a bug with ZimaOS where the fix was simply to reboot ZimaOS and then try again, this time I was able to create a RAID mirror using the two drives. SSDs I did the same for the SSDs, as you will see in the above gallery, when I created the second Storage Pool, it only allowed me to select available drives. ZimaBoard 2 AppData ZimaOS comes with an App Store that includes a repository of almost 400 apps, so you will be able to find most of what you'll need for a NAS (although after a quick search, I wasn't able to find a Surveillance Manager), and now comes the important part: moving the default AppData location off the 45GB eMMC and onto a larger volume: Open Settings Then Apps Then, in the Select a new location field, click on the new Storage volume you want to move it to (in my case, the Apps Storage Pool), which is the SSD RAID mirror. Confirm the Migration warning Be praised! You can also do this for Docker (which by default installs onto the 45GB eMMC flash drive) and the User database. Plex Setup Next, I tested the configuration by installing the Plex Server app from the App Store. The library folders must already exist (which I placed into the Storage Pool). Plex Server setup is straightforward and requires very little configuration. In my case, all I had to do was add the media path I just created, which you can also browse to using the folder icon in the path field. In addition, you can now map the new Media library in Windows Explorer using the Zima Client. Oddly enough, it is not possible to access the ZimaBoard 2 over the Network Neighborhood; you must map drives using the client, which is shown in the last image in the above gallery. I watched one of my Blu-Ray rips, which is Dolby Vision with Dolby Atmos, and the content played fine with no stuttering or buffering, which is what anyone needs in this scenario. ZimaBoard 2 Zima Client mobile app There's also a client for mobile. It is pretty barebones, as shown in the above gallery, for example, the Apps screen launches the WebUI for that app, and the Backup must be done manually. On opening Backup, you can select internal storage folders on your phone to backup to the ZimaBoard 2's storage, and although this is constantly scanned, the backup action itself must be manually triggered. There is an option to allow foreground backup (last image in the above gallery), but this basically means the queued backup gets triggered when you manually open the app. Benchmarking SATA PCIe 3.0 X4 A CrystalDiskMark test on a mapped network drive from within a Windows 11 25H2 PC (image above) connected over a 2.5 GbE was well within acceptable ranges. Writes were generally better on the SSD RAID mirror. SATA PCIe 3.0 X1 I also ran the NAS Performance tester, which tests the link speed performance. As you can see, it pretty much maxes out the 2.5GbE connection. Of course, you can also opt to bond the two 2.5 GbE connections for a bit more umph, but I didn't do that. Thermals Top PCIe card SATA HDDs Next, I measured some hotspots while playing content on Plex. It's fair to say this will perform better than a NAS that is enclosed in a metal or plastic case, as almost everything storage-wise is exposed! Anyway, the ZimaBoard 2 did not break a sweat with Plex streaming or disk benchmarks. ZimaOS Factory Reset ZimaOS does not include a factory reset option. Instead, you have to download the ZimaOS image and flash it to the eMMC manually. The flashing process is shown in the above gallery. The steps to do so are listed below: Download the ZimaOS image here; Open BalenaEtcher (Run as Administrator) and select the image; Select your inserted USB drive (min 8 GB) Flash to it; Connect your USB drive, monitor, keyboard, USB hub (optional), mouse (optional), and network cable (recommended) to the ZimaBoard 2; Connect power and press F11 continuously; Select your USB drive starting with UEFI in the boot device menu; Press Enter on the Install ZimaOS option; Select /dev/mmcblk0 (MMC) flash drive as target; Confirm with (three times) to wipe the target disk; Wait a couple of minutes while ZimaOS installs; Remove the USB drive and confirm with a reboot; Your ZimaBoard 2 has been factory reset. However, you don't have to stick with ZimaOS, in fact the company also offers official CasaOS images, that are based on Debian; or as they say themselves, put anything you want on this "hackable single board server" it's up to you. Conclusion I had a lot of fun putting this together. I've custom-built all my own PCs and servers since the 90s, and this is the first time I have had to put a NAS together. Even if the actual base ZimaBoard 2 was already a completed build, it still feels pretty custom. I just wish that IceWhale Technology included a getting-started guide in the box for the Start Kit, which would have really completed this kit. Instead, I had to search for the official video on the YouTube channel to make sure I wasn't doing anything wrong. So who is this for? Definitely the hobbyist who is comfortable building their own PC and servers. It also has a much smaller footprint than its nearest equivalent (in terms of specs), like the Beelink Me Pro, which is another NAS I will be testing soon. Although the Beelink does not come with the PCIe 3.0 X4 expansion, the ZimaBoard 2 Starter Kit suddenly looks to be a great bargain, even if it only offers the two 3.5-inch bays over the four in the other example. It makes a lot of sense to use Intel's N150 chip inside a NAS; it is more than capable of doing what the ZimaBoard 2 is intended for, media streaming and backup. It also looks like the IceWhale Technology staff are quite active in the official forums helping people with issues they come across with ZimaOS and the devices, peer support seems to be good as well, I was quickly able to find why I was not able to create a new Storage Pool in ZimaOS v1.6.1 even though that is quite a serious bug, hopefully it will be fixed in the next update. If you are comfortable with the command line and Docker, you'll be fine. You can do great things with this hardware. This was my first time with ZimaOS. It seems a bit barebones in comparison to the likes of Synology DSM, TOS, and UGOS, but it has a ton of apps to get you started with your home or small business NAS. Where to buy As of publishing, IceWhale Technology is running a discount of up to 5% for the Starter Kit. If you opt to get just the ZimaBoard 2 itself, it does come with a SATA Y-Cable, so you will be able to connect up to two 3.5-inch HDDs to it. ZimaBoard 2 1668 Starter Kit for $534.50 on Amazon US (was $548.60) ZimaBoard 2 832 Starter Kit for $372.88 on Amazon US (was $390.60) Zimaboard 2 1668 (16GB+64GB) for $419.90 on Amazon US Zimaboard 2 832 (8GB+32GB) for $359.90 on Amazon Disclosure: IceWhale Technology provided a free sample without any editorial input or review pre-approval. Good to know The Amazon link is U.S. specific, and not available in other regions unless specified. We only use first-party seller links (at the time of article publishing); ensure that you purchase from a first-party seller link only. Check out Today's Deals on Amazon | or our recent tech deals. Become a Prime member (for Students or SNAP) via Neowin Get Prime Access - Prime for half price (for qualifying Medicaid, EBT, SNAP) Subscribe to Prime Video, Audible Plus, Music Unlimited or Kindle Unlimited via Neowin As an Amazon Associate, when you purchase through links on our site, we earn from qualifying purchases.
    • It's in the Insider's group so yes it's technically beta, though these days it's hard to see much of a difference unless you opt for the most extreme beta builds, which I don't. When I moved here from the Release Preview channel I did so primarily because I wanted to see how well the restored taskbar functionality (restored from Win10, and earlier) is working and whether it was time to finally abandon SAB--and it is--working fine, so far. Not as polished as SAB, but it'll do for me.
    • I've been using MWB Premium for a number of years so that along with Windows updates and updated browser should be fine. Thanks for that.
  • Recent Achievements

    • Week One Done
      flexorcist earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • Week One Done
      Woland13 earned a badge
      Week One Done
    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      488
    2. 2
      +Edouard
      222
    3. 3
      PsYcHoKiLLa
      147
    4. 4
      Steven P.
      74
    5. 5
      FloatingFatMan
      71
  • Tell a friend

    Love Neowin? Tell a friend!