News for hackers. Stuff that matters.

A comment on Android malware from Amazon straight to your door.

Re:Android malware from Amazon straight to your door by 0x0 on Wednesday January 11, 2023 @05:01PM (#34345606)
I remember looking at a few of these cheapo "androidtv" boxes. My instant reaction was that the entire build seemed super shady and I wouldn't be surprised if they were full of keyloggers and malware. Fortunately I never signed in with a real google account. Some aren't even real AndroidTV, they identify as an Android (not AndroidTV) device in several spots, probably to allow installation of google play applications that aren't designed for androidtv. They often come with multiple app stores, in addition to Google Play (which seems like an unlicensed hack, I would have thought Google would require a minimum of quality for approving a device to carry Google Play, especially for AndroidTV - heck, even uploading a closed alpha testing application that is AndroidTV enabled to google play requires a lot more reviews than regular android apps). All kinds of super weird processes running, some with bundle ids such as just "a" or "com.example.a" (instead of "com.example.realcompanyname.whatever"). If I remember correctly they also came pre-rooted with su/sudo setuid root. The CPU was super weak but they seem to have some sort of hardware accelerated H.264 decoding, that's probably why they can stream and play online HD video, but the minute you try to do anything outside of regular streaming, it is painfully obvious that the chip is weaker than a raspberry pi 1.

To be honest I'm surprised Google is not cracking down hard on this, because it absolutely tarnishes the Android brand. They really feel like a "warez" version of AOSP plus cracked Google Play. I half expected "Google Play Protect" to throw up warnings about the device being non-genuine, but I actually never saw anything of the sorts.

[ Parent | on HN ]
Re:Android malware from Amazon straight to your door by suprjami on Wednesday January 11, 2023 @05:21PM (#34345869)
> I would have thought Google would require a minimum of quality for approving a device to carry Google Play

iiic they require a license to redistribute their binaries, including Google Play. Obviously these boxes running a stolen phone ROM have not paid the licence fee.

As for the rest, these Allwinner chips are actually pretty good, but they're crippled by proprietary drivers and closed device tree. With open drivers and proper software support, they'd probably be equivalent to a Raspberry Pi 3 or better.

I love Android but the ecosystem is already ruined, both by vendor cruft like Samsung's sluggish UI, and by Google Play store being filled with microtransaction cancer. Google Play was good maybe 8 years ago but the lure of Google getting a cut of everyone's IAP destroyed it long ago.

Some obscure cheapo unenforceable Chinese copyright violation has almost no effect in comparison.

[ Parent | on HN ]
Re:Android malware from Amazon straight to your door by Abishek_Muthian on Thursday January 12, 2023 @01:54PM (#34358575)
F-Droid on LineageOS addresses most of the concerns with Playstore as only talented developers who care about open-source release their apps on it.

Ofcourse, Apps of 3rd party data hoarding, Democracy destroying services wouldn't bother releasing to F-Droid and I'm glad for that.

With microG version of LineageOS the app updates are seamless due to the F-Droid PE patch bundled in the ROM.

Lately I'm finding myself increasingly dependent on F-Droid only apps like Termux and Tusky.

[ Parent | on HN ]
Re:Android malware from Amazon straight to your door by suprjami on Thursday January 12, 2023 @03:04PM (#34359523)
I also have F-Droid and Termux installed, but to say this offers a complete or optimal Android experience is false.

There are many good apps only on Google Play, if you know where to look, usually specifically for the app name or by trawling through a dozen inferior alternatives first.

The chances of the best mist respectful apps being suggested to you instead of the Editor Choice in-app-purchase garbage are zero.

[ Parent | on HN ]
Re:Android malware from Amazon straight to your door by Abishek_Muthian on Thursday January 12, 2023 @08:56PM (#34363017)
That's if you don't consider having rootkit-like Google play services as a threat vector or don't mind its impact on the Privacy/Battery backup in the first place.
[ Parent | on HN ]
Re:Android malware from Amazon straight to your door by DesktopECHO on Wednesday January 11, 2023 @05:04PM (#34345650)
These boxes identify themselves as a Google Pixel 2 (walleye) because, reasons!
[ Parent | on HN ]
Re:Android malware from Amazon straight to your door by pifm_guy on Wednesday January 11, 2023 @05:23PM (#34345889)
Which probably means they can upload unlimited photos to Google photos without it counting against the users quota ...
[ Parent | on HN ]
Re:Android malware from Amazon straight to your door by 8zah6q7 on Thursday January 12, 2023 @11:50AM (#34356502)
Only the original Pixel gets unlimited.
[ Parent | on HN ]
Re:Android malware from Amazon straight to your door by megous on Thursday January 12, 2023 @01:38AM (#34349981)
> "...it is painfully obvious that the chip is weaker than a raspberry pi 1"

Rpi1 is 700MHz ARM11. Pretty much anything made in last 8 years to run android is stronger than that.

[ Parent | on HN ]
Re:Android malware from Amazon straight to your door by porbelm on Thursday January 12, 2023 @07:28AM (#34352509)
32-bit single-core, even.
[ Parent | on HN ]
Re:Android malware from Amazon straight to your door by rchaud on Thursday January 12, 2023 @09:50AM (#34354259)
> To be honest I'm surprised Google is not cracking down hard on this, because it absolutely tarnishes the Android brand. They really feel like a "warez" version of AOSP plus cracked Google Play.

Nobody's using these boxes for anything besides pirated IPTV. The market for Android boxes has existed for a decade.

There is not going to be much crossover between people buying hardware like this (to view pirated cable), and the people Google markets Chromecast/Chromeboxes too, because all those do is show paid/ad-funded 'legit' content.

[ Parent | on HN ]