T95 Allwinner T616 Malware Analysis

https://github.com/DesktopECHO/T95-H616-Malware

by DesktopECHO • 4 years ago

221 72 4 years ago

DesktopECHO14• 4 years ago

Follow-up to my earlier report about the stock firmware on these Android TV devices, with a script to de-fang Stage 0 by preventing the payload from downloading (chattr +i FTW!)

LinuxBender2• 4 years ago

For what it's worth that domain in your repo is also listed in the 1Hosts block-list [1] but only in the Xtra category, not sure why. It seems that is a known malware site. Oddly enough it is not listed in the PiHoleBlocklist [2]

[1] https://github.com/badmojr/1Hosts [listed but only in Xtra]

[2] https://github.com/Perflyst/PiHoleBlocklist.git [not listed]

DesktopECHO14• 4 years ago

Yeah only the primary server seems to be on blocklists. The malware uses 3 DNS addresses, all on Linode.

Not that it matters, as the malware uses 8.8.8.8 if it doesn't like the DNS reply -- Then it tries a DNS server on port 5353!

ignoramous3• 4 years ago

Wow, yes, only 1Hosts (Xtra) includes 2 of the 3 command & control domains: https://archive.is/drYgk

I am surprised that none of the usual threats lists have picked these domains up.

Edit: https://github.com/badmojr/1Hosts/issues/964

srhngpr2• 4 years ago

What does this have to do with Amazon specifically, especially when you mention that the same units can be purchased on AliExpress?

"Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize."

DesktopECHO14• 4 years ago

Fair point, thanks. Added AliExpress.

srhngpr2• 4 years ago

Cheers, thank you!

jacquesm• 4 years ago

As the author they could make the article title match the HN one!

tyingq• 4 years ago

It's fairly unrelated to Allwinner also.

le-mark• 4 years ago

Indeed allwinner SOCs are pretty remarkable for how cheap they are.

chasil• 4 years ago

It sounds similar to Barnes and Noble shipping ADUPS on their Nook tablets.

https://www.engadget.com/2016-12-22-barnes-and-noble-nook-sp...

DesktopECHO14• 4 years ago

Funny you mention it, as it also had ADUPS. By itself, I can deal with that.

Actually it more resembles the CopyCat malware. My challenge is finding the hook in system_server that downloads the payload from C2.

* https://www.checkpoint.com/downloads/resources/copycat-resea...

throwawayapples• 4 years ago

ycxrl.com (registered at godaddy with privacy) is the command-and-control domain mentioned in the article, which currently resolves to 192.53.113.52 (Linode). DNS is run through DOMAINCONTROL.COM, which seems to be a nextcloud instance?

perryh2• 4 years ago

The domaincontrol.com nameservers are operated by GoDaddy.

palebluedot• 4 years ago

Looks like 139.162.63.161 may also be involved, it has the same ssh server key:

https://search.censys.io/search?q=services.ssh.server_host_k...

aritmo3• 4 years ago

It's an "Android TV Box", model name "T95". Where is that information in the title?

DesktopECHO14• 4 years ago

Title was changed by the mods so that's how it stays! :)

aritmo3• 4 years ago

It's the same title of your post on github. The mods did not change anything.

pvg2• 4 years ago

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

aritmo3• 4 years ago

"work a little". How is that relevant here?

The "T95" is likely an unbranded TV box and some people that bought it, got pre-installed malware in it. Is that the case with all T95 TV boxes? We don't know. Likely but we don't know.

Did the seller infect the TV boxes with the malware before selling? Probably.

Is this some malware that is implemented in the hardware of the TV box? Hell, no.

neilv• 4 years ago

Nice properties of the Raspberry Pi SoC devices include that there are brands involved that aren't going to fly-by-night, and the brands and the people behind them could be reached by civil and criminal action.

Of course, that doesn't fully prevent malware, but it's a more reassuring than buying something that fell off the back of a truck, in a dark alley(baba).

captainmuon2• 4 years ago

These things also show up on Amazon. I think the real problem is Allwinner. I've dealt with them before and it was nightmarish.

If you want to buy their chips, they insist on setting you up with one of their partners. Fair enough, but that other company is an Allwinner employee's side hustle. They ended up selling us boards that looked like surplus from a settop box project. Outdated, weirdly modified Android version, Google stuff but no license, lots of diagnostic tools installed and ADB wide open like in the article. No source code provided, even though it was agreed upon. We managed to get the source, but it wouldn't build. Then I flew over to our factory in China and asked to meet the guy, so we can sit down and he can show me how to build it. He never came of course, but we suddenly got a mail with the correct source... That's just a fraction of the stories we had with them.

With all the development effort, RMA cases and lost sales I would say our company lost a bunch of money thanks to Allwinner. I wonder how Allwinner still manages to exist. Maybe their stuff is "good enough" in those cases where cheap trumps everything else? We did stick with them for quite a long time and sold a couple of their boards after all...

DesktopECHO14• 4 years ago

Thanks for this fascinating insight. The jankyness you describe lines-up exactly with what I'm seeing here.

If H616 was the mainstream/volume chip box to have in 2021, then I'm super-interested to see what their 2023 H618 boxes look like. They are all over Amazon with loads of reviews on YouTube, just like its predecessor.

Considering the interest this write-up has generated I'm inclined get one and 'take the bullet' to see if this behaviour is continues. Given your insight about how these chips get sold, chances seem quite high.

ilyt• 4 years ago

Maybe their stuff is "good enough" in those cases where cheap trumps everything else?

Well doh.

First of those cheap multimedia CPUs that figures out that having good docs/"out of the box" working open support gives them sales will eat the market.

Also aren't allwinner chips one of better mainstream kernel supported ones out of ARM bunch ?

megous3• 4 years ago

"Nice properties of the Raspberry Pi SoC devices..."

I will only trust devices that have readily available, fully opensource platform firmware, bootloader, and OS. That beats some blind trust in "a massive blob that has control over everything and runs on an independent CPU from OS, because companies would not do bad things, because...brand??" anytime.

verytrivial• 4 years ago

I would be super interested to see what the command and control channel would actually try to do (in a virtual network/honey pot of course).

0x0• 4 years ago

I remember looking at a few of these cheapo "androidtv" boxes. My instant reaction was that the entire build seemed super shady and I wouldn't be surprised if they were full of keyloggers and malware. Fortunately I never signed in with a real google account. Some aren't even real AndroidTV, they identify as an Android (not AndroidTV) device in several spots, probably to allow installation of google play applications that aren't designed for androidtv. They often come with multiple app stores, in addition to Google Play (which seems like an unlicensed hack, I would have thought Google would require a minimum of quality for approving a device to carry Google Play, especially for AndroidTV - heck, even uploading a closed alpha testing application that is AndroidTV enabled to google play requires a lot more reviews than regular android apps). All kinds of super weird processes running, some with bundle ids such as just "a" or "com.example.a" (instead of "com.example.realcompanyname.whatever"). If I remember correctly they also came pre-rooted with su/sudo setuid root. The CPU was super weak but they seem to have some sort of hardware accelerated H.264 decoding, that's probably why they can stream and play online HD video, but the minute you try to do anything outside of regular streaming, it is painfully obvious that the chip is weaker than a raspberry pi 1.

To be honest I'm surprised Google is not cracking down hard on this, because it absolutely tarnishes the Android brand. They really feel like a "warez" version of AOSP plus cracked Google Play. I half expected "Google Play Protect" to throw up warnings about the device being non-genuine, but I actually never saw anything of the sorts.

DesktopECHO14• 4 years ago

These boxes identify themselves as a Google Pixel 2 (walleye) because, reasons!

pifm_guy2• 4 years ago

Which probably means they can upload unlimited photos to Google photos without it counting against the users quota ...

suprjami2• 4 years ago

I would have thought Google would require a minimum of quality for approving a device to carry Google Play

iiic they require a license to redistribute their binaries, including Google Play. Obviously these boxes running a stolen phone ROM have not paid the licence fee.

As for the rest, these Allwinner chips are actually pretty good, but they're crippled by proprietary drivers and closed device tree. With open drivers and proper software support, they'd probably be equivalent to a Raspberry Pi 3 or better.

I love Android but the ecosystem is already ruined, both by vendor cruft like Samsung's sluggish UI, and by Google Play store being filled with microtransaction cancer. Google Play was good maybe 8 years ago but the lure of Google getting a cut of everyone's IAP destroyed it long ago.

Some obscure cheapo unenforceable Chinese copyright violation has almost no effect in comparison.

Abishek_Muthian2• 4 years ago

F-Droid on LineageOS addresses most of the concerns with Playstore as only talented developers who care about open-source release their apps on it.

Ofcourse, Apps of 3rd party data hoarding, Democracy destroying services wouldn't bother releasing to F-Droid and I'm glad for that.

With microG version of LineageOS the app updates are seamless due to the F-Droid PE patch bundled in the ROM.

Lately I'm finding myself increasingly dependent on F-Droid only apps like Termux and Tusky.

megous3• 4 years ago

"...it is painfully obvious that the chip is weaker than a raspberry pi 1"

Rpi1 is 700MHz ARM11. Pretty much anything made in last 8 years to run android is stronger than that.

porbelm• 4 years ago

32-bit single-core, even.

rchaud2• 4 years ago

To be honest I'm surprised Google is not cracking down hard on this, because it absolutely tarnishes the Android brand. They really feel like a "warez" version of AOSP plus cracked Google Play.

Nobody's using these boxes for anything besides pirated IPTV. The market for Android boxes has existed for a decade.

There is not going to be much crossover between people buying hardware like this (to view pirated cable), and the people Google markets Chromecast/Chromeboxes too, because all those do is show paid/ad-funded 'legit' content.

pifm_guy2• 4 years ago

I'd like to see what this malware actually does.

I don't really care if there is malware running in my living room. Makes no difference to me if it runs there or at the north pole. It isn't exactly wasting much of my power or network with a tiny allwinner CPU and probably only 54Mbit WiFi.

And as long as this thing keeps steaming TV, I'm quite happy for it to be full of malware.

nine_k2• 4 years ago

Such malware may sit dormant until ordered to be a small part of a DDoS attack. It will continue stream your TV in the meantime.

Harboring such a pest, typically used in extortion, is just not nice, even if you personally do not directly feel any ill effects.

nibbleshifter• 4 years ago

Or acts as a proxy allowing people to route all kinda of shit through (or into) your network...

A lot of those "residential proxy services" work by routing traffic through infected devices. The operators of them just buy "installs" (dirt cheap) from botnet operators, etc.

An infected device on the home network can also be staging for (automated) attacks against other shit on your network. Fun times.

cpv• 4 years ago

And if someone doubts this, remember the Mirai botnet.

happyopossum• 4 years ago

as long as this thing keeps steaming TV

Using your accounts presumably - so at the very least this thing has access to your hulu/netfliux/hbo/disney+ account information... That alone should be enough to make one reconsider.

DesktopECHO14• 4 years ago

I'm not going to try and change your mind, just sayin' that seems like a really bad idea.

sillystuff• 4 years ago

An Internet connected device with a back-door could be used as a jumping off point to attack other systems on your network.

An Internet connected fishtank thermometer was the initial point of entry for attackers against a casino:

https://www.businessinsider.com/hackers-stole-a-casinos-data...

Without paywall: https://archive.ph/K1nPe

Buffout• 4 years ago

You asked a good question.

Q: What this malware does?

A: probably nothing , but You kind of gave keys to Your device to 3rd party. And 2nd party (that also has keys ) doesn't like that.

Ideally You the owner should have the key and nobody else.

BlueTemplar• 4 years ago

Is John Connor aware of these ? Might just be what reverses the war against Skynet !

andrecarini• 4 years ago

If anyone can offer guidance on how to find these hooks into system_server let me know

You might have some insight using Xposed, but I'm not sure if it works with AndroidTV. Feel free to contact me (email on my profile).

sodality23• 4 years ago

Welp. Had one running for years. ADB'd into it and no sign of an infection despite it being the exact one to be. I don't use anything important on it so I'm considering burning it. OP, do you know of any way to flash a clean OS onto it? If the malware is as deep as it is described maybe a full system reinstall would be best instead of just uninstalling known badware.

DesktopECHO14• 4 years ago

I'm with you on that. There are efforts underway to get plain-old Linux running, but it's some time away as this chip only went into mainline as of kernel 6.0

sodality23• 4 years ago

Agh, your script seemed to have bricked my device. It sends it into a loop forever booting and doesn't reach anything. :/

No big loss though, it hasn't been used in years.

analog31• 4 years ago

Ask HN: I've been thinking about getting an Android tablet to read sheet music. I'm a technically inclined person, but certainly not a security expert. Can anybody recommend one or more online guides for how to find out if a new device contains such egregious malware?

abawany• 4 years ago

I recommend looking at the list of devices recommended by one of LineageOS (https://wiki.lineageos.org/devices/), /e/ (https://doc.e.foundation/devices), or PostmarketOS (assuming the application will run on plain Linux vs. Android) to see if they will work for you. The tablets they recommend are often older models so you will likely have to find these used/refurbished. It might be easier to get a detachable or 360-hinge PC laptop instead (e.g. MS Surface) if the weight/dimensions/application work better for you due to the high flexibility that PC OS-es offer compared to Android. Alternatively, a ChromeOS device, most of which can run Android apps, are a much better bet with long support, respectable vendors, and good flexibility.

rchaud2• 4 years ago

Why not just get something from Samsung? That's a reputable brand and they have no incentive to add in stuff like this. This is a $50 Android box made my some no-name OEM tha sells on Amazon.

userbinator• 4 years ago

Better that it comes with malware you can remove, than a device that has been "secured" against you with unremovable malware under the guise of "security"...

T95 Allwinner T616 Malware Analysis

Related Stories