Hacker News Reader

Comment by Ccecil | Hacker News Reader

About 8 years ago one of our devs purchased a couple Android tablets from China to test if they would work as a host for Smoothieware (and/or 3d printers). It had malware prebundled at the ROM level. You could not remove it by wiping Android (IIRC..our dev that tracked the issue said he had to block what it was doing). The tablet forced your homepage...regardless of what you set it to...and I believe he said it was phoning home info...likely wifi credentials...etc.

It started me off on the thought process of "How many other things can be compromised?" SD cards with fake/hidden partitions? MCU counterfeits with entire subsystems?

IMHO...anything with an ethernet port, wifi, bluetooth...or anything that is able to at any time connect to those things needs to be watched.

View on HN

Ok...response from the dev who did the work. I was a bit mistaken but here are his copied words.

" well it wasn;t actually a ROM malware it was the seller installing their own version of Android, which would reinstall their browser and would not let you change the browser, this browser had a hard coded home page which it forced you too, and it was a home page basically that sells you stuff. if you stopped their browser from getting installed, then the tablet went into a demo mode and displayed huge DEMO text across the whole screen. Eventually I was able to replace several Android core system modules which removed their check that their browser was active. and yea I could see it phoning home whenever it was turned on."

I know I have this device in a box. If anyone would like to analyze it and see if there was more/less than what we found I am willing to send it to someone in the US via ground shipping (LIPO batteries). I believe it was not charging the last time I used it though.

TBH, this sounds like nonsense. What kind of ROM? There are not many ROMs in tablet SoCs. And how would it affect Android install in such a specific way? Wipe the whole eMMC and install a fresh, clean AOSP build and something is forcing a home page in a browser? Without a lot more detail, this sounds all kinds of improbable.

I worked in a factory, where all the pc’s were infected with malware - at the production line too. This would have the unfortunate effect that when we wanted to flash calibration data to the device, malware would write itself to it because the way we would write the data was to a special section of the eMMC that would get mounted as a drive - malware detected a new drive and copied itself. We only discovered it because sometimes the devices wouldn’t boot - I think it took 3 days of nonstop debugging to figure it out. They thought we were crazy, when we finally tried to convince them that something was not right with their setup.

That was a large factory in China. I remember Philips had a production line there also.

I wasn't the one doing the work on it and I may be incorrect about how it was working. It was at a level where it wasn't a simple update software fix...it required more. Asking now to see about specifics.

What I do know for sure was it was bad enough that we decided never use them.

Android uses an A/B partition scheme. Either the bootloader can be infected or both partitions can have the malware. With the A/B split, even if you blow away eg B, A can reinfect B. It would be trivial to add extra circuitry to reinfect both partitions as well.

Right I guess I assumed 'wiping android' meant starting over: erasing the eMMC via TRIM and flashing a new bootloader/repartitioning/etc. via BROM USB mode or something like that.

I guess OP might have meant just 'factory reset'. Which is not really 'wiping the android' at all.

What was the brand / model of the tablet? And did the malware do anything else than force setting your homepage?

I still have one at the shop in a box. I will look when I go there.

Curious because I do use a lot of devices from Chinese makers myself and had no issues so far. If it's from a legit brand, I'd need to take a closer look at their products before buying more.

Here are some pics of the box. Somehow I have the box but cannot find the tablet...but it doesn't exactly surprise me.

https://imgur.com/a/wllzfvj

There literally are no markings or any other type of brand/vendor on the box other than what you see.

lol doesn't look legit. not surprising it malware built in

Does this include headphones that connect to my phone via bluetooth?

That depends. Can those headphones store any amount of information and possibly relay that information to another bluetooth device upon connecting to that? If not...are you absolutely sure it isn't? Anything with memory, a transmitter and an MCU "could" be doing a lot more than it is advertised as doing.

Not saying it is though...but is it possible. Absolutely

Reply on news.ycombinator.com