s905x4 boxes from Aliexpress #5

bt4ibwem8 · 2023-04-17T11:02:07Z

bt4ibwem8
Apr 17, 2023

Did you try also other Android boxes? I would be interested if there is malware also for Amlogic boxes which are pretty popular on Aliexpress...

DesktopECHO · 2023-04-17T11:36:26Z

DesktopECHO
Apr 17, 2023
Maintainer

I have not, would love to know as well.

LTT reviewed a bunch of them but inexplicably did not name which boxes were infected other than to say “almost half”

It would not surprise me if this affected mostly (or only) AllWinner products. See: https://news.ycombinator.com/item?id=34346379 for some insight on how the supply chain works for their chips.

3 replies

bt4ibwem8 Apr 17, 2023
Author

who is LTT?
I still have old s905x box where i flashed custom atv rom (hopefully clean one) but i would rather boot Armbian on it and use as low-powered media server. But i cannot get it booted from usb stick. But i am newbie on linux stuff so probably there is way how to boot Armbian on it. I found the project here on github which make possible to boot Armbian on these boxes.
The point is the hardware is pretty good for the price around $50. We just need to manage how to install/boot Armbian on it :)

DesktopECHO Apr 17, 2023
Maintainer

https://linustechtips.com/topic/1500555-stop-buying-android-tv-boxes/

bt4ibwem8 Apr 17, 2023
Author

Thanks, i have watched the video. I will test that getprop command on my box to find out if i have fake RAM

DesktopECHO · 2023-04-30T16:27:35Z

DesktopECHO
Apr 30, 2023
Maintainer

So far I have not detected any malware on Amlogic-based devices.

2 replies

bt4ibwem8 Apr 30, 2023
Author

which Amlogic models did you check?

DesktopECHO Apr 30, 2023
Maintainer

T95Q-Max (S905)
X98-Plus (S905)

I have not worked on them enough to say they're malware-free, but these devices do not have the Corejava malware issue.

chk-jxcn · 2023-11-13T08:11:24Z

chk-jxcn
Nov 13, 2023

I got a TX6 box few years ago, which chip is S905, and I found it send a lots of junk email those days, not sure it send from android system or app installed:

Nov 13 03:00:41 tinc-bwg sm-mta[75769]: 3ACJ0NpC075769: ruleset=check_rcpt, arg1=<4439809148@txt.att.net>, relay=[192.168.30.130], reject=550 5.7.1 <4439809148@txt.att.net>... Relaying denied. IP name lookup failed [192.168.30.130]
Nov 13 03:00:41 tinc-bwg sm-mta[75768]: 3ACJ0MJZ075768: ruleset=check_rcpt, arg1=<5712478229@txt.att.net>, relay=[192.168.30.130], reject=550 5.7.1 <5712478229@txt.att.net>... Relaying denied. IP name lookup failed [192.168.30.130]
Nov 13 03:00:41 tinc-bwg sm-mta[75769]: 3ACJ0NpC075769: ruleset=check_rcpt, arg1=<9193486729@txt.att.net>, relay=[192.168.30.130], reject=550 5.7.1 <9193486729@txt.att.net>... Relaying denied. IP name lookup failed [192.168.30.130]
Nov 13 03:00:41 tinc-bwg sm-mta[75768]: 3ACJ0MJZ075768: ruleset=check_rcpt, arg1=<9085284766@txt.att.net>, relay=[192.168.30.130], reject=550 5.7.1 <9085284766@txt.att.net>... Relaying denied. IP name lookup failed [192.168.30.130]
Nov 13 03:00:42 tinc-bwg sm-mta[75769]: 3ACJ0NpC075769: ruleset=check_rcpt, arg1=<9106893565@txt.att.net>, relay=[192.168.30.130], reject=550 5.7.1 <9106893565@txt.att.net>... Relaying denied. IP name lookup failed [192.168.30.130]
Nov 13 03:00:42 tinc-bwg sm-mta[75768]: 3ACJ0MJZ075768: ruleset=check_rcpt, arg1=<4438212566@txt.att.net>, relay=[192.168.30.130], reject=550 5.7.1 <4438212566@txt.att.net>... Relaying denied. IP name lookup failed [192.168.30.130]

1 reply

chk-jxcn Nov 13, 2023

BTW, I live in china, and I never found any weird traffic send from this box before I connect it to VPN which will forward traffic to US (and I see it ask for dns query for domain checkip.amazon.com). So I believe there are some conditions to make malware wake up.

s905x4 boxes from Aliexpress #5

Uh oh!

bt4ibwem8 Apr 17, 2023

Replies: 3 comments · 6 replies

Uh oh!

Uh oh!

DesktopECHO Apr 17, 2023 Maintainer

Uh oh!

Uh oh!

bt4ibwem8 Apr 17, 2023 Author

Uh oh!

DesktopECHO Apr 17, 2023 Maintainer

Uh oh!

bt4ibwem8 Apr 17, 2023 Author

Uh oh!

DesktopECHO Apr 30, 2023 Maintainer

Uh oh!

bt4ibwem8 Apr 30, 2023 Author

Uh oh!

DesktopECHO Apr 30, 2023 Maintainer

Uh oh!

chk-jxcn Nov 13, 2023

Uh oh!

chk-jxcn Nov 13, 2023

bt4ibwem8
Apr 17, 2023

Replies: 3 comments 6 replies

DesktopECHO
Apr 17, 2023
Maintainer

bt4ibwem8 Apr 17, 2023
Author

DesktopECHO Apr 17, 2023
Maintainer

bt4ibwem8 Apr 17, 2023
Author

DesktopECHO
Apr 30, 2023
Maintainer

bt4ibwem8 Apr 30, 2023
Author

DesktopECHO Apr 30, 2023
Maintainer

chk-jxcn
Nov 13, 2023