Link: https://old.reddit.com/r/homelab/comments/1vpirvn/beware_geakos/

This is an automated archive made by the Lemmit Bot.

The original was posted on /r/homelab by /u/ZookeepergameSalty10 on 2026-08-16 00:36:16+00:00.

A Chinese company reached out to me to test and review their nas software called Geak OS, i was skeptical due it not being open source but i need YouTube content and beginner friendly stuff always does numbers so i gave it a shot. It was spun up on a vm on a vlan with only internet access, the only other machine on the vlan was a box running wireshark pointed at the server vm.

As soon as the system was installed it began reaching out over bittorrent dht protocol and contacted about 650 peers, one of those peers tried to send QUIC packets to pull data from a russian website but the system did fortunately reject those.

The server also performed an api call to register itself which is not uncommon except it was sent in raw json over HTTP with no encryption and included a lot of personal and identifying data including ip address, also exposed private and public keys in the same json.

The machine came loaded with 27 docker registries (3 were useless placeholders).

On their actual iso i found multiple exposed keys and login info to different registries.

The system has no form of raid, zfs or any kind of redundancy, so its also useless as a nas.

26 different services run as root after install even with none of the apps from the store installed.

I found a lot of other concerning things that ill cover in a video but to anyone looking into that system, at the least its not to be trusted for long term and at the worst it could be a potential gateway to a botnet. If your in the market for a nas that can run homelab stuff go with truenas or unraid or literally anything thats been proven.

I wanted to write this up here because when i was doing my initial research i could not find any english reviews on reddit or youtube of the software, not even a mention outside of the creators trying to advertise it. On top of being a security nightmare the software was mid at best and the only thing it actually did well was be a NAS. Their APK is not signed with play so its a download from their site (passed play protect scan but i still used it on a burner to be safe) and not a single bit is open source. If you get approached as a creator, avoid the system until these concerns can be addressed if you are a user, just outright avoid it. Im far from a real security researcher so if any of you guys that are more capable than me want to take a look id love some more findings from more skilled people. I did reach out to the company via email with my list of findings and will try ti remember to post an update here if they try to explain why a server with no apps instantly connects to DHT network (for the unaware its how torrents work, but can also be used for botnets, vpns or other attacks) at this point the review is the smallest part of my video about the software