5 ms·

About 8 years ago one of our devs purchased a couple Android tablets from China to test if they would work as a host for Smoothieware (and/or 3d printers). It

by Ccecil 5y ago

About 8 years ago one of our devs purchased a couple Android tablets from China to test if they would work as a host for Smoothieware (and/or 3d printers). It had malware prebundled at the ROM level. You could not remove it by wiping Android (IIRC..our dev that tracked the issue said he had to block what it was doing). The tablet forced your homepage...regardless of what you set it to...and I believe he said it was phoning home info...likely wifi credentials...etc. It started me off on the thought process of "How many other things can be compromised?" SD cards with fake/hidden partitions? MCU counterfeits with entire subsystems? IMHO...anything with an ethernet port, wifi, bluetooth...or anything that is able to at any time connect to those things needs to be watched.

johnmoonyy 5y ago
Does this include headphones that connect to my phone via bluetooth?
- Ccecil 5y ago
  That depends. Can those headphones store any amount of information and possibly relay that information to another bluetooth device upon connecting to that? If not...are you absolutely sure it isn't? Anything with memory, a transmitter and an MCU "could" be doing a lot more than it is advertised as doing. Not saying it is though...but is it possible. Absolutely
deleted 5y ago
[deleted]
echevil 5y ago
What was the brand / model of the tablet? And did the malware do anything else than force setting your homepage?
- Ccecil 5y ago
  I still have one at the shop in a box. I will look when I go there.
  - echevil 5y ago
    Curious because I do use a lot of devices from Chinese makers myself and had no issues so far. If it's from a legit brand, I'd need to take a closer look at their products before buying more.
    - Ccecil 5y ago
      Here are some pics of the box. Somehow I have the box but cannot find the tablet...but it doesn't exactly surprise me. https://imgur.com/a/wllzfvj https://imgur.com/a/wllzfvj There literally are no markings or any other type of brand/vendor on the box other than what you see.
      - echevil 5y ago
        lol doesn't look legit. not surprising it malware built in
megous 5y ago
TBH, this sounds like nonsense. What kind of ROM? There are not many ROMs in tablet SoCs. And how would it affect Android install in such a specific way? Wipe the whole eMMC and install a fresh, clean AOSP build and something is forcing a home page in a browser? Without a lot more detail, this sounds all kinds of improbable.
- Ccecil 5y ago
  I wasn't the one doing the work on it and I may be incorrect about how it was working. It was at a level where it wasn't a simple update software fix...it required more. Asking now to see about specifics. What I do know for sure was it was bad enough that we decided never use them.
- vorpalhex 5y ago
  Android uses an A/B partition scheme. Either the bootloader can be infected or both partitions can have the malware. With the A/B split, even if you blow away eg B, A can reinfect B. It would be trivial to add extra circuitry to reinfect both partitions as well.
  - megous 5y ago
    Right I guess I assumed 'wiping android' meant starting over: erasing the eMMC via TRIM and flashing a new bootloader/repartitioning/etc. via BROM USB mode or something like that. I guess OP might have meant just 'factory reset'. Which is not really 'wiping the android' at all.
- mads 5y ago
  I worked in a factory, where all the pc’s were infected with malware - at the production line too. This would have the unfortunate effect that when we wanted to flash calibration data to the device, malware would write itself to it because the way we would write the data was to a special section of the eMMC that would get mounted as a drive - malware detected a new drive and copied itself. We only discovered it because sometimes the devices wouldn’t boot - I think it took 3 days of nonstop debugging to figure it out. They thought we were crazy, when we finally tried to convince them that something was not right with their setup. That was a large factory in China. I remember Philips had a production line there also.
deleted 5y ago
[deleted]
Ccecil 5y ago
Ok...response from the dev who did the work. I was a bit mistaken but here are his copied words. " well it wasn;t actually a ROM malware it was the seller installing their own version of Android, which would reinstall their browser and would not let you change the browser, this browser had a hard coded home page which it forced you too, and it was a home page basically that sells you stuff. if you stopped their browser from getting installed, then the tablet went into a demo mode and displayed huge DEMO text across the whole screen. Eventually I was able to replace several Android core system modules which removed their check that their browser was active. and yea I could see it phoning home whenever it was turned on." I know I have this device in a box. If anyone would like to analyze it and see if there was more/less than what we found I am willing to send it to someone in the US via ground shipping (LIPO batteries). I believe it was not charging the last time I used it though.

by Ccecil 5y ago

johnmoonyy 5y ago

Does this include headphones that connect to my phone via bluetooth?

Ccecil 5y ago
That depends. Can those headphones store any amount of information and possibly relay that information to another bluetooth device upon connecting to that? If not...are you absolutely sure it isn't? Anything with memory, a transmitter and an MCU "could" be doing a lot more than it is advertised as doing. Not saying it is though...but is it possible. Absolutely

deleted 5y ago

[deleted]

echevil 5y ago

What was the brand / model of the tablet? And did the malware do anything else than force setting your homepage?

Ccecil 5y ago
I still have one at the shop in a box. I will look when I go there.
- echevil 5y ago
  Curious because I do use a lot of devices from Chinese makers myself and had no issues so far. If it's from a legit brand, I'd need to take a closer look at their products before buying more.
  - Ccecil 5y ago
    Here are some pics of the box. Somehow I have the box but cannot find the tablet...but it doesn't exactly surprise me. https://imgur.com/a/wllzfvj https://imgur.com/a/wllzfvj There literally are no markings or any other type of brand/vendor on the box other than what you see.
    - echevil 5y ago
      lol doesn't look legit. not surprising it malware built in

megous 5y ago

TBH, this sounds like nonsense. What kind of ROM? There are not many ROMs in tablet SoCs. And how would it affect Android install in such a specific way? Wipe the whole eMMC and install a fresh, clean AOSP build and something is forcing a home page in a browser? Without a lot more detail, this sounds all kinds of improbable.

Ccecil 5y ago
I wasn't the one doing the work on it and I may be incorrect about how it was working. It was at a level where it wasn't a simple update software fix...it required more. Asking now to see about specifics. What I do know for sure was it was bad enough that we decided never use them.
vorpalhex 5y ago
Android uses an A/B partition scheme. Either the bootloader can be infected or both partitions can have the malware. With the A/B split, even if you blow away eg B, A can reinfect B. It would be trivial to add extra circuitry to reinfect both partitions as well.
- megous 5y ago
  Right I guess I assumed 'wiping android' meant starting over: erasing the eMMC via TRIM and flashing a new bootloader/repartitioning/etc. via BROM USB mode or something like that. I guess OP might have meant just 'factory reset'. Which is not really 'wiping the android' at all.
mads 5y ago
I worked in a factory, where all the pc’s were infected with malware - at the production line too. This would have the unfortunate effect that when we wanted to flash calibration data to the device, malware would write itself to it because the way we would write the data was to a special section of the eMMC that would get mounted as a drive - malware detected a new drive and copied itself. We only discovered it because sometimes the devices wouldn’t boot - I think it took 3 days of nonstop debugging to figure it out. They thought we were crazy, when we finally tried to convince them that something was not right with their setup. That was a large factory in China. I remember Philips had a production line there also.

deleted 5y ago

[deleted]

Ccecil 5y ago

Ok...response from the dev who did the work. I was a bit mistaken but here are his copied words. " well it wasn;t actually a ROM malware it was the seller installing their own version of Android, which would reinstall their browser and would not let you change the browser, this browser had a hard coded home page which it forced you too, and it was a home page basically that sells you stuff. if you stopped their browser from getting installed, then the tablet went into a demo mode and displayed huge DEMO text across the whole screen. Eventually I was able to replace several Android core system modules which removed their check that their browser was active. and yea I could see it phoning home whenever it was turned on." I know I have this device in a box. If anyone would like to analyze it and see if there was more/less than what we found I am willing to send it to someone in the US via ground shipping (LIPO batteries). I believe it was not charging the last time I used it though.