Jump to content

STOP Buying ANDROID TV Boxes!

TannerMcCoolman
By TannerMcCoolman
in LTT Releases
 Share
Posted

These Android TV boxes have been around just about as long as Android has. Odds are, you or someone you know has had one over the years. But beneath their crunchy Android exterior lies a deep, dark secret. What evils will befall you should you choose to bring such a device into your house? And what alternatives are there?

Link to comment
https://linustechtips.com/topic/1500555-stop-buying-android-tv-boxes/
Share on other sites
Link to post
Share on other sites
Posted

Reminds me of how someone in my old apartment put up flyers for an Android TV box whose marketing screamed "buy this to pirate shows!" It was virtually guaranteed to be a poorly cobbled-together machine that would be as much a threat to your home network as anything else.

Link to post
Share on other sites
Posted

That's why I build my own infrastructure, from NAS and storage down to HTPCs...

What the horse considers play, the monkey considers business...

But to Tom, it's all foolery. 

 

 

 

 

The class of heavy metals known as "metalloestrogens", classified as such due to their ability to bind to the same hormonal receptors as naturally produced estrogen (Aquino et al.), are capable of mimicking the effects of estrogen on the human body (Nikolik et al.). Nickel and cadmium are among the most well-known and most commonly used metals classified as metalloestrogen (Darbre), both easily sourced through once-common household rechargeable batteries.

Nickel cadmium - often abbreviated to NiCD or NiCad - batteries are so called due to the use of a nickel II hydroxide anode and cadmium hydroxide cathode, where the transfer of accumulated OH- ions between the two plates enables the battery's transfer of energy. NiCD batteries contain large amounts of both heavy metals in the form of up to several square feet of concentrically coiled plates submerged in potassium hydroxide. Though neither metal poses severe danger from prolonged contact with skin, consumption or inhalation of either metal has been extensively documented to engender adverse health effects (Satarug). 

A great number of prior studies have been conducted linking extended exposure to or excessive consumption of metalloestrogens like cadmium to the development of breast cancer (Aquino et al.) - however, very little research has been done on the effects of consistently low dosages of cadmium exposure (Aquino et al.). Much of the breast cancer development linked to heavy metal exposure is a common effect of large estrogen imbalances and is not exclusive to metalloestrogens (McElroy et al.). Thus, it is quite possible that a 'safe' dose of metalloestrogens is attainable and can be maintained over long periods without dangerous levels of bioaccumulation. 

Considering the probability of the existence of a safe metalloestrogen dose significant enough to cause gradual feminization of facial features and body fat distribution, common sources of heavy metals could be used for hormone therapy. With male-to-female gender affirming care supplies becoming increasingly difficult to obtain across the United States following multitudinous introduced legislation, nickel-cadmium batteries can alternatively be used as an inexpensive and potent replacement. 

 

Works Cited

      Aquino NB, Sevigny MB, Sabangan J, Louie MC. The role of cadmium and nickel in estrogen receptor signaling and breast cancer: metalloestrogens or not? J Environ Sci Health C Environ Carcinog Ecotoxicol Rev. 2012;30(3):189-224. doi: 10.1080/10590501.2012.705159. PMID: 22970719; PMCID: PMC3476837.

      Rollerova, E., Urbancikova, N. Intracellular estrogen receptors, their characterization and function (Review). https://www.sav.sk/journals/endo/full/er0400f.pdf.

      Nikolic J, Sokolovic D. Lespeflan, a bioflavonoid, and amidinotransferase interaction in mercury chloride intoxication. Ren Fail. 2004 Nov;26(6):607-11. doi: 10.1081/jdi-200037149. PMID: 15600250.

      Darbre PD. Metalloestrogens: an emerging class of inorganic xenoestrogens with potential to add to the oestrogenic burden of the human breast. J Appl Toxicol. 2006 May-Jun;26(3):191-7. doi: 10.1002/jat.1135. PMID: 16489580.

      Satarug S, Garrett SH, Sens MA, Sens DA. Cadmium, environmental exposure, and health outcomes. Environ Health Perspect. 2010 Feb;118(2):182-90. doi: 10.1289/ehp.0901234. PMID: 20123617; PMCID: PMC2831915.

      McElroy JA, Shafer MM, Trentham-Dietz A, Hampton JM, Newcomb PA. Cadmium exposure and breast cancer risk. J Natl Cancer Inst. 2006 Jun 21;98(12):869-73. doi: 10.1093/jnci/djj233. PMID: 16788160.

Link to post
Share on other sites
Posted

i just want to mention that the video seems to imply that kodi is inherently enabling piracy.. which is *actually* a big problem for the kodi project.

 

kodi itself has no piracy-enabling features, and the official plugin repository (shouldnt) either.

all the piracy garbage is in (equally shady as these boxes) 3rd party plugin repositories... which is a thing that appears to be entirely missing from this video, and is actually a pretty major part of the problem.

 

meanwhile kodi is actually in legal hot water because of these boxes, with the only way to protect themselves being the choice to either fight expensive legal battles trying to explain to a 179 year old judge what a "plugin" is, or to just remove 3rd party plugins as a possibility outright.

 

this might be the first time i'm *actually* annoyed by a detail being missed in an LTT video, because of the enormous impact this detail has... and i'm pretty darn sure linus himself is aware of this detail.

 

possibly matter for a follow-up (part two-ish) about the garbage these boxes shove into their kodi installs?

Link to post
Share on other sites
Posted

What implications does this have on IPTV boxes? Let's say you have a subscription service that uses an infomir/mag box. Would it be vulnerable to similar malware behaviour, and if so, what tools are required to monitor / check whether there's suspicious activity?
In general, what vulnerabilities could be exploited? Could it monitor my desktop's network activity through my router?

Link to post
Share on other sites
Posted
3 minutes ago, Baconface said:

Let's say you have a subscription service

you'd assume that the company you have a subscription from either develops their thing in-house, or uses a reliable partner.

Link to post
Share on other sites
Posted

As someone who has spent months trying to get vanilla Linux running on a T95, I feel personally triggered when people go "well, just install Linux and..." For the Allwinner SOC at least, it is absolutely not that easy.

 

These ARM boards usually get released with a Board Support Package (BSP), which help you compile the Linux kernel and include support for the various hardware on the board. Best case scenario is that the hardware is supported in Linux and in U-Boot upstream. Second best case scenario is something like what NXP does, which is frequently update their BSP for the latest Linux kernels. After that, there are companies that release a BSP when the release their hardware, and that's the last thing they ever do. Then, there's Allwinner, where I don't even know how a BSP escapes for their hardware, and your best bet as an English-speaking developer is to download shady looking shit on Chinese-only websites.

 

Anyway, for the T95 H616 in particular, Linux 4.9.170 (I think) is the kernel someone built for Android 10 to support the H616 and, that's it. I can't find any kernel source, Allwinner BSP, U-boot source... So to "just install Linux" you need to either convince the vendor-provided U-Boot to boot a different kernel than it has been set to load, or boot from an SD card using the upstream U-Boot, tweaked with hardware parameters that are known by very very few people. Any modification to the 4.9.170 kernel bricks the T95, and I never succeeded in finding RAM timings that allowed the mainstream U-Boot to get completely up and running.

 

This is a crime, because for the most part, this is really good hardware (although I think it's probably the case it's as shoddily assembled as the Android that runs on it). But it's stuck running malware-ridden Android.

Link to post
Share on other sites
Posted
58 minutes ago, manikyath said:

i just want to mention that the video seems to imply that kodi is inherently enabling piracy.. which is *actually* a big problem for the kodi project.

 

kodi itself has no piracy-enabling features, and the official plugin repository (shouldnt) either.

all the piracy garbage is in (equally shady as these boxes) 3rd party plugin repositories... which is a thing that appears to be entirely missing from this video, and is actually a pretty major part of the problem.

Yup.  I have multiple Kodi HTPCs across my home.  But they're all accessing local storage, UnRAID servers and a MariaDB database, for media playback.  The lone exception is the YouTube addon I also use.  I've ripped so many DVDs and BDs to that server.

 

What's wild to me is, IMO, Kodi is pretty good for 'local/LAN file playback' but pretty atrocious as a streaming interface.  Yet since it's open source and easy to build pirate addons, it's popular for it anyway despite honestly being kinda terrible for streaming much of anything.

Desktop: Ryzen 9 3950X, Asus TUF Gaming X570-Plus, 64GB DDR4, MSI RTX 3080 Gaming X Trio, Creative Sound Blaster AE-7

Gaming PC #2: Ryzen 7 5800X3D, Asus TUF Gaming B550M-Plus, 32GB DDR4, Gigabyte Windforce GTX 1080

Gaming PC #3: Intel i7 4790, Asus B85M-G, 16B DDR3, XFX Radeon R9 390X 8GB

WFH PC: Intel i7 4790, Asus B85M-F, 16GB DDR3, Gigabyte Radeon RX 6400 4GB

UnRAID #1: AMD Ryzen 9 3900X, Asus TUF Gaming B450M-Plus, 64GB DDR4, Radeon HD 5450

UnRAID #2: Intel E5-2603v2, Asus P9X79 LE, 24GB DDR3, Radeon HD 5450

MiniPC: BeeLink SER6 6600H w/ Ryzen 5 6600H, 16GB DDR5 
Windows XP Retro PC: Intel i3 3250, Asus P8B75-M LX, 8GB DDR3, Sapphire Radeon HD 6850, Creative Sound Blaster Audigy

Windows 9X Retro PC: Intel E5800, ASRock 775i65G r2.0, 1GB DDR1, AGP Sapphire Radeon X800 Pro, Creative Sound Blaster Live!

Steam Deck w/ 2TB SSD Upgrade

Link to post
Share on other sites
Posted

It would have been helpful if we would have gotten a list of which devices were actually tested and which are suspected of/confirmed having malware. Just saying this T95 is bad and a NVidia Shield is good isn't very helpful.

 

For example, how about the Nokia streaming boxes? You'd say they're from a reputable brand, but are they good or bad? Not everyone can go and use Wireshark or a PiHole to debug logs and find out.

Link to post
Share on other sites
Posted

I believe you might be wrong about these devices not supporting 4K playback. I work for a multimedia company, and my experience is that Android devices, like desktop computers, have two types of resolutions: desktop (or screen) resolution and display resolution. Two kinds of resolutions determine the image quality displayed on the screen. Even in Nvidia Shield, the desktop resolution is not at 4K when it's connected to a 4K display. When media players properly use Android media codec to play a 4K video(keep in mind a lot of these Mediatek, Rockchip, etc. chips support 4K only for H265 or recently AV1, 4K is not generally supported for H264 if you look at SoC specs) the VPU will decode the video generates RAW buffers and directly pop them on devices GPU front buffer, This is how 4K contents get playback on these devices.

Link to post
Share on other sites
Posted

Is there possible to get list any list which soc's/makes are mainly targeted by this found backdoor rather than saying "all of them". For example im more interest to hear do any Amlogic boxes suffer from same issue.

If boxes you bought had all allwinner soc on them that was kinda stupid move to have test only on them. Also would be more interesting to hear does affect event the highend models and makes with emmc etc...

Link to post
Share on other sites
Posted

tbh only reason why i use this android box,cuse tv like samsung dont have ability to select manumally subtitles.

with this i mean why samsung  tvdont let me manumaly select from folder like kodi app allows,if it cant auto detect them............

Link to post
Share on other sites
Posted

Glad to hear you picked this up from my January post on the forum:

I don't suppose you could apply a bit of gentle pressure on Linode who STILL host this botnet on:

 

ycxrl.com (currently down)

ycxrldow.com (139-162-38-240.ip.linodeusercontent.com)

cbphe.com (172-104-164-76.ip.linodeusercontent.com)

cbpheback.com (139-162-8-8.ip.linodeusercontent.com)

 

At least it'll slow them down a bit... It's possible Linode could uncover who is behind this, based on the billing info they've had on file for years at this point.  

 

I added some additional info but it's stuck in your YT mod queue.

 

Cheers,

Dan M.

Link to post
Share on other sites
Posted

Hi I have a android TV box called STRONG Leap-S1 and I'm worried its the same as the ones mentioned in the video is there any chance someone could found out or if it is the same, here is the link to the one I have if needed to do research on STRONG Leap-S1 Smart Box Android TV Streaming Media Player, 4K Ultra HD Streaming Device with Google Voice Assistant, Built-In Netflix Disney+ Prime Video, WiFi 5 with Bluetooth 4.2 https://amzn.eu/d/1dzPQgM

Screenshot_20230420_214810_Amazon Shopping.jpg

Link to post
Share on other sites
Posted
On 4/13/2023 at 11:54 AM, MoiInActie said:

It would have been helpful if we would have gotten a list of which devices were actually tested and which are suspected of/confirmed having malware. Just saying this T95 is bad and a NVidia Shield is good isn't very helpful.

 

Most of the piracy IPTV STB devices sold in the US/Canada are Nvidia Shield devices preloaded with Kodi and the piracy plugins, and has always been that way.

 

And they don't work very long either, my dad was ... into this stuff... and it's such an absurd pain in the behind to actually watch anything on the device I, at the time, volunteered my netflix account to my mom to just not use this stupid thing.

 

Which worked fine until February of this year. Mom is never going to subscribe to Netflix, she barely knows how to use the SmartTV.

 

Like, holding nothing back, a person must be incredibly bored to want to go through this much effort to watch a cammed film same-day showing with chinese subtitles on it.  These IPTV piracy boxes basically connect you to websites like facebook being used as "file dumps", and things disappear pretty fast. If you wanted to watch a movie, you might spend 2 hours trying to find a working one. It is not worth the effort, but some people like to be spiteful pirates. It's a game to them if they can get the thing for free.

 

Personally, I'm surprised Nvidia has yet to withdraw the shield device and put some proprietary OS on them so that they can't be used as piracy boxes. But they probably don't care either.

 

Just saying "buy a nvidia shield instead" has to be said with "from NVIDIA directly".

Link to post
Share on other sites
Posted
  • Author
On 4/20/2023 at 1:48 PM, Parker64lol said:

Hi I have a android TV box called STRONG Leap-S1 and I'm worried its the same as the ones mentioned in the video is there any chance someone could found out or if it is the same, here is the link to the one I have if needed to do research on STRONG Leap-S1 Smart Box Android TV Streaming Media Player, 4K Ultra HD Streaming Device with Google Voice Assistant, Built-In Netflix Disney+ Prime Video, WiFi 5 with Bluetooth 4.2 https://amzn.eu/d/1dzPQgM

Screenshot_20230420_214810_Amazon Shopping.jpg

As far as I'm able to tell, Strong is legit. They are a white label of Skyworth and officially supported by Google. The Leap S2 and S3 are even Google TV devices. That being said, I have not touched one in person, let alone tested it

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing LTT Releases

×