DesktopECHO

قبل 3 سنواتdiscuss

If anyone on Windows would like to see what performance is like, I updated my WSL installer scripts to use this version of XRDP.

Ubuntu XFCE: https://github.com/DesktopECHO/xWSL

KDE Neon: https://github.com/DesktopECHO/kWSL

Kali: https://github.com/DesktopECHO/Kali-xRDP

These scripts will build a complete RDP-accessible Linux desktop environment in WSL. A GPU isn't needed to see a significant performance gain over 'stock' XRDP.

DesktopECHO

قبل 3 سنواتdiscuss

I don't see anything with regards to inclusion of the Clear Codec (RDP8.1 + H.264) in Fedora builds.

If there is evidence indicating this is actually the case, please let me know.

DesktopECHO

قبل 3 سنواتdiscuss

That's client side. FreeRDP needs H.264 libraries to work with this branch of XRDP. Apparently, Ubuntu and variants do not include this in their FreeRDP builds, good to know it's in Debian though.

(MSTSC.EXE and the official macOS RDP client already have H.264 support built-in)

DesktopECHO

قبل 3 سنواتdiscuss

I believe your writeup is about enabling Glamor; it does not do anything to enable the H.264 "Clear Codec" branch of XRDP.

Apologies in advance if I'm wrong here, please correct me if I'm mistaken :)

DesktopECHO

قبل 3 سنواتdiscuss

https://github.com/DesktopECHO/T95-H616-Malware#25-apr-2023-...

> Thanks to Tanner at LTT for letting me review his findings - It appears the scope of this issue is much bigger than expected; many Android TV Boxes with the AllWinner H616, H618 and RockChip RK3328 feature the "Corejava" C2 Bootstrap.

DesktopECHO

قبل 4 سنواتdiscuss

Not this one.

> Nope. While basic Linux support is slowly materializing, two major blockers are still at the same spot - HDMI audio (no useful driver) and bug in display driver (big code change may be required to fix it).

https://forum.libreelec.tv/thread/24275-allwinner-h616-suppo...

DesktopECHO

قبل 4 سنواتdiscuss

Clearly you never saw the original title before it was changed by the mods, but believe whatever you like.

DesktopECHO

قبل 4 سنواتdiscuss

Wow sorry to hear that. If you can, check if the device is still available over ADB. If it is, try re-running the script.

Not sure what happened in your case, I flashed many ROMs and ran the script against them to see if anything bad would happen. No issues.

In any case it won't be a Hard Brick. Power off, hold [volume-up] insert power jack and tap the [power] button 10 times. (I think. I lost my remote ages ago and can't check.)

DesktopECHO

قبل 4 سنواتdiscuss

I'm with you on that. There are efforts underway to get plain-old Linux running, but it's some time away as this chip only went into mainline as of kernel 6.0

DesktopECHO

قبل 4 سنواتdiscuss

I'm not going to try and change your mind, just sayin' that seems like a really bad idea.

DesktopECHO

قبل 4 سنواتdiscuss

Thanks for this fascinating insight. The jankyness you describe lines-up exactly with what I'm seeing here.

If H616 was the mainstream/volume chip box to have in 2021, then I'm super-interested to see what their 2023 H618 boxes look like. They are all over Amazon with loads of reviews on YouTube, just like its predecessor.

Considering the interest this write-up has generated I'm inclined get one and 'take the bullet' to see if this behaviour is continues. Given your insight about how these chips get sold, chances seem quite high.

DesktopECHO

قبل 4 سنواتdiscuss

These boxes identify themselves as a Google Pixel 2 (walleye) because, reasons!

DesktopECHO

قبل 4 سنواتdiscuss

I'm not too surprised, as the malware goes out of its way to use ycxrl.com -- Going to extents like using 8.8.8.8 instead of the default DNS server, and trying a DNS server on port 5353.

Using those techniques, nobody would get a chance to see this second fall-back.

EDIT to clarify: Thanks for listing this, it's definately good to list these addresses as 'bad' for others to be aware, but DNS blocking won't slow down this malware, not even a bit.

Here's what it took for me to see cbpheback.com -- Install Pi-hole on the Android device and add these rules to iptables:

  adb shell iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p tcp --dport 5353 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p udp --dport 5353 -j DNAT --to 127.0.0.1:53

DesktopECHO

قبل 4 سنواتdiscuss

Title was changed by the mods so that's how it stays! :)

DesktopECHO

قبل 4 سنواتdiscuss

Thanks for the guidance here. Where I'm really stuck is when tcpdump tells me about the presence of the offending traffic and correlating process. In this case, it's the Android "system_server" process and I'm not sure how to find the hook into it that downloads the malware.

In hindsight I should have made this an Ask HN post...

DesktopECHO

قبل 4 سنواتdiscuss

Funny you mention it, as it also had ADUPS. By itself, I can deal with that.

Actually it more resembles the CopyCat malware. My challenge is finding the hook in system_server that downloads the payload from C2.

* https://www.checkpoint.com/downloads/resources/copycat-resea...

DesktopECHO

قبل 4 سنواتdiscuss

Fair point, thanks. Added AliExpress.

DesktopECHO

قبل 4 سنواتdiscuss

Yeah only the primary server seems to be on blocklists. The malware uses 3 DNS addresses, all on Linode.

Not that it matters, as the malware uses 8.8.8.8 if it doesn't like the DNS reply -- Then it tries a DNS server on port 5353!

DesktopECHO

قبل 4 سنواتdiscuss

Follow-up to my earlier report about the stock firmware on these Android TV devices, with a script to de-fang Stage 0 by preventing the payload from downloading (chattr +i FTW!)

DesktopECHO

قبل 4 سنواتdiscuss

I went the Linux Deploy route and published a couple of container images that Just Work on pretty much any ARM Android device.

Once you shiv systemd, some pretty elaborate scripts can run in an Android chroot just like they would on bare-metal ARM. Just think of your old Android as an off-brand rPi with case, built-in touchscreen LCD, and way, way fewer GPIO pins. No surprise the server will need a new UPS battery.

NextCloudDroid: https://github.com/DesktopECHO/nextcloudpi Pi-hole for Android: https://github.com/DesktopECHO/Pi-hole-for-Android

DesktopECHO

Submissions

Sometimes the best SBC is the one already gathering dust in your desk drawer

XRDP with H.264 codec brings immense performance boost

The situation with malware on Android TV ROMs is ridiculous

WSL1 Is Dying from Neglect

T95 Allwinner T616 Malware Analysis

Owner of an Android TV box? May want to check if it's an active botnet member...

comments