T95 Allwinner T616 Malware Analysis | Hacker News Reader

T95 Allwinner T616 Malware Analysis

github.com

221 pointsDesktopECHO72 comments

Follow-up to my earlier report about the stock firmware on these Android TV devices, with a script to de-fang Stage 0 by preventing the payload from downloading (chattr +i FTW!)

For what it's worth that domain in your repo is also listed in the 1Hosts block-list [1] but only in the Xtra category, not sure why. It seems that is a known malware site. Oddly enough it is not listed in the PiHoleBlocklist [2]

[1] - https://github.com/badmojr/1Hosts [listed but only in Xtra]

[2] - https://github.com/Perflyst/PiHoleBlocklist.git [not listed]

Yeah only the primary server seems to be on blocklists. The malware uses 3 DNS addresses, all on Linode.

Not that it matters, as the malware uses 8.8.8.8 if it doesn't like the DNS reply -- Then it tries a DNS server on port 5353!

Another thing to look at if you have time is packet characteristics. I have found that many malware and bot installations appear to use really odd network libraries. Just do a tcpdump for a while and see what sticks out, such as missing MSS, really high TTL, missing SackOK, timestamps enabled this seems to be default on Android. Also look at the TCP header sizes vs. the normal TCP header sizes from legit devices on your network.

    tcpdump -i any -p -NNnnt -s0 -c512 proto 6 and 'tcp[13] == 2' # get syn packets, use "-i any" to see direction

I'm not sure where malware authors find their libraries but they do not try at all to look like normal traffic [Edit] or perhaps their government is telling them to add/remove specific options.

Thanks for the guidance here. Where I'm really stuck is when tcpdump tells me about the presence of the offending traffic and correlating process. In this case, it's the Android "system_server" process and I'm not sure how to find the hook into it that downloads the malware.

In hindsight I should have made this an Ask HN post...

just reading you comment about differing packets, I was already thinking that seems like a dumb thing to have look different. Then you end with exactly that. Just goes to so that the world is so insecure that even minimal effort will get quite a return in this world. If it gets a big enough return so that even those that do stop it still makes it worth while, then why spend energy trying to do more. Hell, even Bill Gates is attributed to saying something about why should he pay for optimizing when disk space and cpu is always increasing faster than any optimizations could.

Wow, yes, only 1Hosts (Xtra) includes 2 of the 3 command & control domains: https://archive.is/drYgk

I am surprised that none of the usual threats lists have picked these domains up.

Edit: https://github.com/badmojr/1Hosts/issues/964

I'm not too surprised, as the malware goes out of its way to use ycxrl.com -- Going to extents like using 8.8.8.8 instead of the default DNS server, and trying a DNS server on port 5353.

Using those techniques, nobody would get a chance to see this second fall-back.

EDIT to clarify: Thanks for listing this, it's definately good to list these addresses as 'bad' for others to be aware, but DNS blocking won't slow down this malware, not even a bit.

Here's what it took for me to see cbpheback.com -- Install Pi-hole on the Android device and add these rules to iptables:

  adb shell iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p tcp --dport 5353 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p udp --dport 5353 -j DNAT --to 127.0.0.1:53

> ..but DNS blocking won't slow down this malware, not even a bit.

Yep, in a world of encrypted DNS transports, it is a folly to believe that DNS-based blocks would be affective at thwarting any sort of malware. That said, some IoC (indicators of compromise) setups do rely on it nevertheless.

just because something new comes along doesn't mean you stop doing the thing that worked for all of the older/existing things. otherwise, the existing things start working.

you make it sound like people dumb for relying on something that works in certain situations. that's just hubris on your part if that's what you actually feel.

You make it sound like I compared DNS-based security to snake oil. That's just futuristic thinking on your part (:

>setups do rely on it nevertheless.

this is where I'm drawing my conclusion. no snake oil accusations necessary. the sentence is read with an implied "nevertheless, [dumbasses|idiots|noobies]" type of ending

ycxrl.com (registered at godaddy with privacy) is the command-and-control domain mentioned in the article, which currently resolves to 192.53.113.52 (Linode). DNS is run through DOMAINCONTROL.COM, which seems to be a nextcloud instance?

The domaincontrol.com nameservers are operated by GoDaddy.

Looks like 139.162.63.161 may also be involved, it has the same ssh server key:

https://search.censys.io/search?q=services.ssh.server_host_k...

I remember looking at a few of these cheapo "androidtv" boxes. My instant reaction was that the entire build seemed super shady and I wouldn't be surprised if they were full of keyloggers and malware. Fortunately I never signed in with a real google account. Some aren't even real AndroidTV, they identify as an Android (not AndroidTV) device in several spots, probably to allow installation of google play applications that aren't designed for androidtv. They often come with multiple app stores, in addition to Google Play (which seems like an unlicensed hack, I would have thought Google would require a minimum of quality for approving a device to carry Google Play, especially for AndroidTV - heck, even uploading a closed alpha testing application that is AndroidTV enabled to google play requires a lot more reviews than regular android apps). All kinds of super weird processes running, some with bundle ids such as just "a" or "com.example.a" (instead of "com.example.realcompanyname.whatever"). If I remember correctly they also came pre-rooted with su/sudo setuid root. The CPU was super weak but they seem to have some sort of hardware accelerated H.264 decoding, that's probably why they can stream and play online HD video, but the minute you try to do anything outside of regular streaming, it is painfully obvious that the chip is weaker than a raspberry pi 1.

To be honest I'm surprised Google is not cracking down hard on this, because it absolutely tarnishes the Android brand. They really feel like a "warez" version of AOSP plus cracked Google Play. I half expected "Google Play Protect" to throw up warnings about the device being non-genuine, but I actually never saw anything of the sorts.

These boxes identify themselves as a Google Pixel 2 (walleye) because, reasons!

Which probably means they can upload unlimited photos to Google photos without it counting against the users quota ...

Only the original Pixel gets unlimited.

> I would have thought Google would require a minimum of quality for approving a device to carry Google Play

iiic they require a license to redistribute their binaries, including Google Play. Obviously these boxes running a stolen phone ROM have not paid the licence fee.

As for the rest, these Allwinner chips are actually pretty good, but they're crippled by proprietary drivers and closed device tree. With open drivers and proper software support, they'd probably be equivalent to a Raspberry Pi 3 or better.

I love Android but the ecosystem is already ruined, both by vendor cruft like Samsung's sluggish UI, and by Google Play store being filled with microtransaction cancer. Google Play was good maybe 8 years ago but the lure of Google getting a cut of everyone's IAP destroyed it long ago.

Some obscure cheapo unenforceable Chinese copyright violation has almost no effect in comparison.

F-Droid on LineageOS addresses most of the concerns with Playstore as only talented developers who care about open-source release their apps on it.

Ofcourse, Apps of 3rd party data hoarding, Democracy destroying services wouldn't bother releasing to F-Droid and I'm glad for that.

With microG version of LineageOS the app updates are seamless due to the F-Droid PE patch bundled in the ROM.

Lately I'm finding myself increasingly dependent on F-Droid only apps like Termux and Tusky.

I also have F-Droid and Termux installed, but to say this offers a complete or optimal Android experience is false.

There are many good apps only on Google Play, if you know where to look, usually specifically for the app name or by trawling through a dozen inferior alternatives first.

The chances of the best mist respectful apps being suggested to you instead of the Editor Choice in-app-purchase garbage are zero.

That's if you don't consider having rootkit-like Google play services as a threat vector or don't mind its impact on the Privacy/Battery backup in the first place.

> "...it is painfully obvious that the chip is weaker than a raspberry pi 1"

Rpi1 is 700MHz ARM11. Pretty much anything made in last 8 years to run android is stronger than that.

32-bit single-core, even.

> To be honest I'm surprised Google is not cracking down hard on this, because it absolutely tarnishes the Android brand. They really feel like a "warez" version of AOSP plus cracked Google Play.

Nobody's using these boxes for anything besides pirated IPTV. The market for Android boxes has existed for a decade.

There is not going to be much crossover between people buying hardware like this (to view pirated cable), and the people Google markets Chromecast/Chromeboxes too, because all those do is show paid/ad-funded 'legit' content.

I would be super interested to see what the command and control channel would actually try to do (in a virtual network/honey pot of course).

It sounds similar to Barnes and Noble shipping ADUPS on their Nook tablets.

https://www.engadget.com/2016-12-22-barnes-and-noble-nook-sp...

Funny you mention it, as it also had ADUPS. By itself, I can deal with that.

Actually it more resembles the CopyCat malware. My challenge is finding the hook in system_server that downloads the payload from C2.

* https://www.checkpoint.com/downloads/resources/copycat-resea...

Welp. Had one running for years. ADB'd into it and no sign of an infection despite it being the exact one to be. I don't use anything important on it so I'm considering burning it. OP, do you know of any way to flash a clean OS onto it? If the malware is as deep as it is described maybe a full system reinstall would be best instead of just uninstalling known badware.

I'm with you on that. There are efforts underway to get plain-old Linux running, but it's some time away as this chip only went into mainline as of kernel 6.0

Agh, your script seemed to have bricked my device. It sends it into a loop forever booting and doesn't reach anything. :/

No big loss though, it hasn't been used in years.

Wow sorry to hear that. If you can, check if the device is still available over ADB. If it is, try re-running the script.

Not sure what happened in your case, I flashed many ROMs and ran the script against them to see if anything bad would happen. No issues.

In any case it won't be a Hard Brick. Power off, hold [volume-up] insert power jack and tap the [power] button 10 times. (I think. I lost my remote ages ago and can't check.)

Yep I actually toyed around with it and got it to boot - thanks for the help!

> If anyone can offer guidance on how to find these hooks into system_server let me know

You might have some insight using Xposed, but I'm not sure if it works with AndroidTV. Feel free to contact me (email on my profile).

Nice properties of the Raspberry Pi SoC devices include that there are brands involved that aren't going to fly-by-night, and the brands and the people behind them could be reached by civil and criminal action.

Of course, that doesn't fully prevent malware, but it's a more reassuring than buying something that fell off the back of a truck, in a dark alley(baba).

These things also show up on Amazon. I think the real problem is Allwinner. I've dealt with them before and it was nightmarish.

If you want to buy their chips, they insist on setting you up with one of their partners. Fair enough, but that other company is an Allwinner employee's side hustle. They ended up selling us boards that looked like surplus from a settop box project. Outdated, weirdly modified Android version, Google stuff but no license, lots of diagnostic tools installed and ADB wide open like in the article. No source code provided, even though it was agreed upon. We managed to get the source, but it wouldn't build. Then I flew over to our factory in China and asked to meet the guy, so we can sit down and he can show me how to build it. He never came of course, but we suddenly got a mail with the correct source... That's just a fraction of the stories we had with them.

With all the development effort, RMA cases and lost sales I would say our company lost a bunch of money thanks to Allwinner. I wonder how Allwinner still manages to exist. Maybe their stuff is "good enough" in those cases where cheap trumps everything else? We did stick with them for quite a long time and sold a couple of their boards after all...

Thanks for this fascinating insight. The jankyness you describe lines-up exactly with what I'm seeing here.

If H616 was the mainstream/volume chip box to have in 2021, then I'm super-interested to see what their 2023 H618 boxes look like. They are all over Amazon with loads of reviews on YouTube, just like its predecessor.

Considering the interest this write-up has generated I'm inclined get one and 'take the bullet' to see if this behaviour is continues. Given your insight about how these chips get sold, chances seem quite high.

Yeah, I must admit that I have a morbid fascination with these devices. I mean they are cheap and hackable after all. And after reading your article I also thought about getting a new one to see what they are up to these days :-D.

> Maybe their stuff is "good enough" in those cases where cheap trumps everything else?

Well doh.

First of those cheap multimedia CPUs that figures out that having good docs/"out of the box" working open support gives them sales will eat the market.

Also aren't allwinner chips one of better mainstream kernel supported ones out of ARM bunch ?

Allwinner SoCs have very good mainline support, including most of their multimedia capabilities and can run LibreELEC just fine.

Not this one.

> Nope. While basic Linux support is slowly materializing, two major blockers are still at the same spot - HDMI audio (no useful driver) and bug in display driver (big code change may be required to fix it).

https://forum.libreelec.tv/thread/24275-allwinner-h616-suppo...

> "Nice properties of the Raspberry Pi SoC devices..."

I will only trust devices that have readily available, fully opensource platform firmware, bootloader, and OS. That beats some blind trust in "a massive blob that has control over everything and runs on an independent CPU from OS, because companies would not do bad things, because...brand??" anytime.

What does this have to do with Amazon specifically, especially when you mention that the same units can be purchased on AliExpress?

"Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize."

Fair point, thanks. Added AliExpress.

Cheers, thank you!

As the author they could make the article title match the HN one!

It's fairly unrelated to Allwinner also.

Indeed allwinner SOCs are pretty remarkable for how cheap they are.

It's an "Android TV Box", model name "T95". Where is that information in the title?

Title was changed by the mods so that's how it stays! :)

It's the same title of your post on github. The mods did not change anything.

Clearly you never saw the original title before it was changed by the mods, but believe whatever you like.

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

"work a little". How is that relevant here?

The "T95" is likely an unbranded TV box and some people that bought it, got pre-installed malware in it. Is that the case with all T95 TV boxes? We don't know. Likely but we don't know.

Did the seller infect the TV boxes with the malware before selling? Probably.

Is this some malware that is implemented in the hardware of the TV box? Hell, no.

"work a little" is you click on the article and it tells you what it's about in the first couple of paragraphs. Or you do what many people do and go straight to the comments and they tell you. All of the stuff you typed above is not going to get resolved in a title anyway.

Here's a couple of specific mod comments if you didn't get that far in the search results:

https://news.ycombinator.com/item?id=21589370

https://news.ycombinator.com/item?id=21394893

Ask HN: I've been thinking about getting an Android tablet to read sheet music. I'm a technically inclined person, but certainly not a security expert. Can anybody recommend one or more online guides for how to find out if a new device contains such egregious malware?

I recommend looking at the list of devices recommended by one of LineageOS (https://wiki.lineageos.org/devices/), /e/ (https://doc.e.foundation/devices), or PostmarketOS (assuming the application will run on plain Linux vs. Android) to see if they will work for you. The tablets they recommend are often older models so you will likely have to find these used/refurbished. It might be easier to get a detachable or 360-hinge PC laptop instead (e.g. MS Surface) if the weight/dimensions/application work better for you due to the high flexibility that PC OS-es offer compared to Android. Alternatively, a ChromeOS device, most of which can run Android apps, are a much better bet with long support, respectable vendors, and good flexibility.

Why not just get something from Samsung? That's a reputable brand and they have no incentive to add in stuff like this. This is a $50 Android box made my some no-name OEM tha sells on Amazon.

Better that it comes with malware you can remove, than a device that has been "secured" against you with unremovable malware under the guise of "security"...

Is John Connor aware of these ? Might just be what reverses the war against Skynet !

I'd like to see what this malware actually does.

I don't really care if there is malware running in my living room. Makes no difference to me if it runs there or at the north pole. It isn't exactly wasting much of my power or network with a tiny allwinner CPU and probably only 54Mbit WiFi.

And as long as this thing keeps steaming TV, I'm quite happy for it to be full of malware.

Such malware may sit dormant until ordered to be a small part of a DDoS attack. It will continue stream your TV in the meantime.

Harboring such a pest, typically used in extortion, is just not nice, even if you personally do not directly feel any ill effects.

Or acts as a proxy allowing people to route all kinda of shit through (or into) your network...

A lot of those "residential proxy services" work by routing traffic through infected devices. The operators of them just buy "installs" (dirt cheap) from botnet operators, etc.

An infected device on the home network can also be staging for (automated) attacks against other shit on your network. Fun times.

> An infected device on the home network can also be staging for (automated) attacks against other shit on your network. Fun times

Oh? With what result at the end of all that?

Otherwise this reads like typical "infosec" fearmongering turned up to 11. No different than doomsday preppers.

Your windows machine likely have more lax permissions for the internal LAN. It's easier to try and install a keylogger, and steal your passwords on various sites, card numbers, etc.

This all gets bought and sold on black markets, and gets used weeks and months after being stolen. Spam sent covertly from your mail account, mystery charges on your CC, etc. Not pleasant. At the worst case, a full identity theft, then behold a $30k loan taken in your name, for you to repay with interest.

Windows machine? Others are bulletproof? Mac has never been used as an attack vector by a malicious actor?

What if a super-volcano erupts tomorrow, do you have enough canned beans?

And if someone doubts this, remember the Mirai botnet.

> as long as this thing keeps steaming TV

Using your accounts presumably - so at the very least this thing has access to your hulu/netfliux/hbo/disney+ account information... That alone should be enough to make one reconsider.

I'm not going to try and change your mind, just sayin' that seems like a really bad idea.

An Internet connected device with a back-door could be used as a jumping off point to attack other systems on your network.

An Internet connected fishtank thermometer was the initial point of entry for attackers against a casino:

https://www.businessinsider.com/hackers-stole-a-casinos-data...

Without paywall: https://archive.ph/K1nPe

You asked a good question.

Q: What this malware does?

A: probably nothing , but You kind of gave keys to Your device to 3rd party. And 2nd party (that also has keys ) doesn't like that.

Ideally You the owner should have the key and nobody else.

Reply on news.ycombinator.com