DesktopECHO

Ubuntu XFCE: https://github.com/DesktopECHO/xWSL

KDE Neon: https://github.com/DesktopECHO/kWSL

Kali: https://github.com/DesktopECHO/Kali-xRDP

These scripts will build a complete RDP-accessible Linux desktop environment in WSL. A GPU isn't needed to see a significant performance gain over 'stock' XRDP.

If there is evidence indicating this is actually the case, please let me know.

(MSTSC.EXE and the official macOS RDP client already have H.264 support built-in)

Apologies in advance if I'm wrong here, please correct me if I'm mistaken :)

> Thanks to Tanner at LTT for letting me review his findings - It appears the scope of this issue is much bigger than expected; many Android TV Boxes with the AllWinner H616, H618 and RockChip RK3328 feature the "Corejava" C2 Bootstrap.

> Nope. While basic Linux support is slowly materializing, two major blockers are still at the same spot - HDMI audio (no useful driver) and bug in display driver (big code change may be required to fix it).

https://forum.libreelec.tv/thread/24275-allwinner-h616-suppo...

Not sure what happened in your case, I flashed many ROMs and ran the script against them to see if anything bad would happen. No issues.

In any case it won't be a Hard Brick. Power off, hold [volume-up] insert power jack and tap the [power] button 10 times. (I think. I lost my remote ages ago and can't check.)

If H616 was the mainstream/volume chip box to have in 2021, then I'm super-interested to see what their 2023 H618 boxes look like. They are all over Amazon with loads of reviews on YouTube, just like its predecessor.

Considering the interest this write-up has generated I'm inclined get one and 'take the bullet' to see if this behaviour is continues. Given your insight about how these chips get sold, chances seem quite high.

Using those techniques, nobody would get a chance to see this second fall-back.

EDIT to clarify: Thanks for listing this, it's definately good to list these addresses as 'bad' for others to be aware, but DNS blocking won't slow down this malware, not even a bit.

Here's what it took for me to see cbpheback.com -- Install Pi-hole on the Android device and add these rules to iptables:

  adb shell iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p tcp --dport 5353 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p udp --dport 5353 -j DNAT --to 127.0.0.1:53

In hindsight I should have made this an Ask HN post...

Actually it more resembles the CopyCat malware. My challenge is finding the hook in system_server that downloads the payload from C2.

* https://www.checkpoint.com/downloads/resources/copycat-resea...

Not that it matters, as the malware uses 8.8.8.8 if it doesn't like the DNS reply -- Then it tries a DNS server on port 5353!

Once you shiv systemd, some pretty elaborate scripts can run in an Android chroot just like they would on bare-metal ARM. Just think of your old Android as an off-brand rPi with case, built-in touchscreen LCD, and way, way fewer GPIO pins. No surprise the server will need a new UPS battery.

NextCloudDroid: https://github.com/DesktopECHO/nextcloudpi Pi-hole for Android: https://github.com/DesktopECHO/Pi-hole-for-Android

This site can’t provide a secure connection

sslping.com sent an invalid response. ERR_SSL_PROTOCOL_ERROR

/Ironic

Sounds to me like your PC is busted.

PH4WSL1.CMD is unique in that it uses WSL1, not virtualization or containers, and is extremely easy to set up.

It needs a fraction of resources compared to other 'virtual' rPi appliances and runs on older CPU's without VT support, or on a VPS that doesn't pass-through virtualization support. For example it runs well on an old laptop with 1 CPU core and 2GB of RAM; consuming an imperceptible amount of host OS resources.

It can be used to block ads on your entire network but real/dedicated hardware is probably a better idea in that situation. Its ideal use is for ad-blocking on-the-go instead of needing to manage a HOSTS file on your laptop, or to have a look at Pi-hole's feature set before committing to a hardware purchase.