Thousands of Android devices come with unkillable backdoor preinstalled
arstechnica.com
Somehow, advanced Triada malware was added to devices before reaching resellers.
  • @9point6@lemmy.worldEnglish
    52•1 year ago

    Worth pointing out this isn’t any proper Android TV devices, but rather those cheap boxes that are often basically SBCs with AOSP installed on them which are predominantly sold as easy piracy boxes.

    Edit: in fact, the article doesn’t currently have TV in the title

    • @Vent@lemm.eeOPEnglish
      6•1 year ago

      Leaving out the TV makes it less precise and more clickbaity because then it sounds like Android phones are affected.

      • @9point6@lemmy.worldEnglish
        7•1 year ago

        I guess the problem is that “Android TV” is a specific thing that none of these devices actually are, they’re just dodgy boxes running Android that can be plugged into a TV.

        For me it’s more clickbaity because Android TV isn’t actually involved here at all.

        • KubeRootEnglish
          4•1 year ago

          I’d say it would be more clickbaity if you just removed the “TV”, because it’d make you think of smartphones, and those would be much more concerning

          • @9point6@lemmy.worldEnglish
            2•1 year ago

            Yeah I’m not sure what the correct headline is, but at least for me I definitely clicked because I thought it was to do with Android TV, which it wasn’t. It was about those cheap boxes that anyone reading Ars already knows are probably filled with malware

        • @planish@sh.itjust.worksEnglish
          0•1 year ago

          Aren’t the boxes running “Android TV”, the set top box oriented flavor of Android, with e.g. the launcher designed to be operated with a TV remote and not a touch screen?

          They are not themselves TVs, though, and I guess nowdays it might be most common for “Android TV” to run on the TV instead of on a separate device.

      • deweydecibelEnglish
        3•1 year ago

        Why not just find a different website reporting the story with a better headline? Rather than sharing the one with the headline you fear is misleading?

        • @Vent@lemm.eeOPEnglish
          2•1 year ago

          It’s only slightly misleading and Arstechnica writes really good articles. It’s pretty much the only news site I regularly browse.

    • DarkThoughts
      10•1 year ago

      Are non smart TVs even still a thing nowadays? I don’t own or watch any TV so I honestly don’t know how the market currently looks like.

        • wjrii
          8•1 year ago

          Depends on your definition of “quite pricey.” There’s no equivalent of a $250 50" Insignia FireTV, but I’ve seen Samsung signage displays on Amazon for about a $75-$100 premium over their comparable Smart TVs. They also don’t come with a stand, so if you weren’t already buying a VESA mount you’ll need to add another $40-80. There is a significant premium, but it’s not necessarily orders of magnitude.

      • guyrocket
        11•1 year ago

        Apparently “smartness” has not invaded projectors…per a comment I read here on kbin a while back from a projector owner. This really encourages me to buy one.

      • Chozo
        7•1 year ago

        They’re harder to find, for sure. Especially if you want a large screen.

        When I was shopping around a few years ago, the only 65" TV I could find without smart features was a Sceptre, which is Walmart’s electronics brand. Speakers so bad that I had to buy a sound bar, and the display isn’t that great, but it gets the job done and I don’t need to worry about it being an attack vector.

      • 𝒍𝒆𝒎𝒂𝒏𝒏English
        1•1 year ago

        Yepp - hop on Ebay or some surplus auction site, and search for commercial/signage displays. Don’t bother buying new unless you have the money for it IMO, they are expensive unless you get them used

        Edit: typo

      • ChaoticNeutralCzechEnglish
        -1•1 year ago
        1. Connect old PC to TV. Both can be 15 years old.
        2. (optional) For better performance, get a small SSD alongside the big HDD (a 64GB / partition will do), maybe have a homemade NAS ready too
        3. Install Lubuntu, Mint XFCE, Puppy Linux or any other distro of choice
        4. Set up KDE Connect, qBittorrent and VLC
        5. Enjoy
        • @Limit@lemm.eeEnglish
          1•1 year ago

          OK I’ve tried in the past to make a decent streaming box from both windows media center edition and various Linux distros. But I need something that is simple, can be controlled entirely from a remote, and has the major streaming apps (Netflix, disney, etc). I haven’t really found any solution that’s easy enough for non techie people to use. I have a standalone roku box that works ok we also have a roku TV which is a giant piece of garbage, and I’m considering buying an external roku or nvidia shield as a streaming box instead, I do have a couple of raspberry pi 4s I could use one but again I’m faced with the same issues.

    • Maximilious
      -4•1 year ago

      You’re going to build your own smart TV that can handle new HDMI and Displayport advancements too?

      • @dustyData@lemmy.worldEnglish
        9•1 year ago

        This is going to come as a shock to you, but HDMI has been a thing since 2004. You can find 15 year old dumb TVs with HDMI. If the TV had HDMI, it can handle any format that the screen can physically show and newer versions are backwards compatible.

      • @Sethayy@sh.itjust.worksEnglish
        5•1 year ago

        Almost any ARM SBC and a dumb TV will do, install linux/a minimal wayland compositor and waydroid and youre laughing

        Any time there’s a advancement you just update the board, instead of the whole TV (which its not like normal smart TV’s update their ports anyways?)

    • 👁️👄👁️English
      -4•1 year ago

      I swear shit like this is why Lemmy is so incredibly out of touch with the real world. I can’t take the community seriously anymore.

      • @smileyhead@discuss.tchncs.deEnglish
        1•1 year ago

        Because something is not popular and not available in typical electronic store doesn’t mean it’s not real.

        I know having a private life may seem unreal in recent ~10 years, but it surely can be done without giving up modern life. All it takes is a little time for research and saying “no” sometimes. The hardest part are always areas where more people like that are needed to say “no”.

  • @redcalcium@lemmy.instituteEnglish
    21•1 year ago

    These are just generic Android TV devices that use Allwinner board. Allwinner made these kind of generic boards for Android TV and Android Auto head unit and sell them to OEMs. The OEMs then “customize” it by adding their APKs into the ROM provided by Allwinner. I doubt the malware come from Allwinner. Maybe it’s just one (or more) OEM that include whatever APK they found on the internet without checking.

  • @ubermeisters@lemmy.worldEnglish
    9•1 year ago

    Owning a smart TV is one of the stupidest things you can do.

    I’m admittedly this type of stupid, but I also know how to blacklist all the domains my garbage ass Vizio tries to phone home to.

    They make the devices cheap so that they can spy on you. It’s the New Deal.

    Edit: I see i’m not the only one who gave up on finding a reasonable TV and just opted to neuter a Smart TV instead. Now that I’m not in a position of “me want now, nothing in local store”, I think Ill take a few moments to do some research for everyone, and myself, just to highlight that there actually are still options. Heres a few brands I found that still offer Dumb TVs. I know nothing else about these, and am not in any way promoting these brands or claiming they are good at all. IDK.

    This is not endorsement

    If anyone has relevant info about these brands, related to if they are good or suck… let me know.

    • Eggyhead
      9•1 year ago

      Do modern TVs even come in non-smart variants anymore?

      • @Rai@lemmy.dbzer0.comEnglish
        6•1 year ago

        It doesn’t really matter, just don’t connect them to the internet. Our TV just has a 14 year old computer that plays media perfectly, and is completely cut off from the internet.

      • @ubermeisters@lemmy.worldEnglish
        2•1 year ago

        its called a monitor

        Edit, i felt bad about being a smart ass, and edited my parent comment to be more… helpful

    • @jvisick@programming.devEnglish
      4•1 year ago

      Admittedly I haven’t been looking that hard, but I don’t think I’ve seen a TV for sale in the past 10 years that wasn’t a “smart” TV.

    • @DudeDudenson@lemmings.worldEnglish
      2•1 year ago

      I’m annoyed that they don’t sell them and that even if you don’t connect a smart tv to wifi to keep it dumb it’ll still not just be a display and it’ll try to shove stuff in your face

      • @viking@infosec.pubEnglish
        1•1 year ago

        Most TVs have an office or presentation mode hidden somewhere in the settings, that will get rid of the ad-ridden interface and replace it with a plain and functional one. That plus no wifi, ever, gets them sorted.

  • @Kissaki@feddit.deEnglish
    8•1 year ago

    In total the researchers confirmed eight devices with backdoors installed—seven TV boxes, the T95, T95Z, T95MAX, X88, Q9, X12PLUS, and MXQ Pro 5G, and a tablet J5-W.

    The other thing discussed is fraudulent android apps that have been removed from the play store.

  • AutoTL;DRBEnglish
    7•1 year ago

    This is the best summary I could come up with:

    This week, cybersecurity firm Human Security is revealing new details about the scope of the infected devices and the hidden, interconnected web of fraud schemes linked to the streaming boxes.

    “They’re like a Swiss Army knife of doing bad things on the Internet,” says Gavin Reid, the CISO at Human Security who leads the company’s Satori Threat Intelligence and Research team.

    “This is a truly distributed way of doing fraud.” Reid says the company has shared details of facilities where the devices may have been manufactured with law enforcement agencies.

    In the second half of 2022, Human Security says in its report, its researchers spotted an Android app that appeared to be linked to inauthentic traffic and connected to the domain flyermobi.com.

    When Milisic posted his initial findings about the T95 Android box in January, the research also pointed to the flyermobi domain.

    The company’s report, which has data scientist Marion Habiby as its lead author, says Human Security spotted at least 74,000 Android devices showing signs of a Badbox infection around the world—including some in schools across the US.

    The original article contains 455 words, the summary contains 180 words. Saved 60%. I’m a bot and I’m open source!

  • wjrii
    3•1 year ago

    My OctoPrint server runs on one of these (previous homeowners left it lying around), but I completely nuked Android and installed the Armbian distro for the Inovato Quadra (itself just a carefully sourced and rebranded TV box). It was tedious though, and I’d never buy one for that purpose when there are dedicated SBCs.

  • Possibly linuxEnglish
    1•1 year ago

    Its called google and it infects all stock android devices

    Anyway I actually have one of those devices. It was support to be a birthday present but it came with some baggage. By the time I realized it I couldn’t return it

    • @heeplr@feddit.deEnglish
      2•1 year ago

      installing your own OS and/or bootloader is a pain and most of the time unfeasable. And that’s the only way to safely kill software based backdoors.