- Subscription streaming services
are getting to the point
where they cost as much
as a cable subscription used to.
I mean, it's no wonder
people are setting sail
for the streaming seas.
That is where this
morally ambiguous plastic box comes in.
It can be had for about the price
of a family outing to McDonald's,
and promises to provide cheap,
or even free access
to copyrighted content for anyone.
No technical skills required.
I mean, there must be a catch, right?
Ooh, now that's a yikes.
DesktopEcho's discovery
of a pre-installed backdoor
on the T95 made us wonder,
is it a one-off
or does it impact the plethora
of similar Android boxes
available on: Amazon,
Ali Express,
and nearly every other online marketplace?
To find out,
we bought a whole stack of them.
And as it turns out,
the T95s backdoor
is only the tip of the iceberg.
So then, are any of these things worth buying,
or do they all need to go
straight to the landfill?
Like I'm gonna go straight to this segue,
to our sponsor.
iFixit.
Is your battery not lasting
as long as it used to?
Looking for a new project?
iFixit has you covered.
Stay tuned to the end of the video to learn more
about their battery replacement kits.
Legally questionable set top boxes
are nothing new.
Way back in 2009,
I talked about the Popcorn Hour C-200,
whose big party trick
was the ability to stream from torrents
rather than waiting for them
to finish downloading.
There's a big market for this kind of stuff,
and, as part of the Napster generation,
I may or may not have
dabbled myself at some point.
No judgment.
However, it's important to remember
that the kinds of folks who are willing
to help you circumvent copyright law
tend to be the same kinds of folks
who don't care about other laws either.
Like privacy or data collection laws.
To which you might think,
come on, Linus,
how bad could it be?
Let's have a look.
Booting up any one of these boxes,
you're gonna be greeted
with a friendly setup process
and brought to a home screen that looks
at least vaguely like Android TV.
If you're running a pie hole
like DesktopEcho was,
this might be the point
where you start to see red flags.
In what seems to be a best case scenario,
the box might be trying to ping an address
with F-O-T-A in the URL.
F-O-T-A stands for Firmware-Over-The-Air,
and is relatively standard Android behavior.
What isn't relatively standard,
is that if you look up the IP,
that URL is gonna point to a place
that at least someone refers to as China.
Now, this isn't a problem in and of itself,
but with China's looser regulations,
especially with respect to foreign nationals,
it means that there are no guarantees
that the firmware that you download
will be clean
or that it will even be firmware at all.
In a much worse scenario,
your experience will mimic DesktopEcho's,
who found countless attempts to contact URLs
that were made up of jumbled letters
and lesser used top level domains
that were attempting to dump payloads
into the now notorious Core Java directory.
This matters
because this directory
appears to be a relative of CopyCat,
an Android malware
with truly terrifying capabilities.
The original
infected an estimated 14 million devices
and was designed primarily
to generate and steal ad revenue.
But given that it can root your device,
inject itself alongside apps that you launch,
and control your network activity,
it can be used
for all kinds of nefarious activities.
Coming back to our devices then,
when inspecting their file systems
using Android Debug Bridge,
we found almost half of them
had the same Core Java folder
and open preferences file,
even if they didn't immediately
try to access any questionable URLs.
Another one had the Core Java folder
though it was empty,
as if the firmware image that they used
contained the same malware at some point
but it was removed.
Did they have a change of heart?
Did they accidentally
break the malware's functionality,
or did they remove it to install something worse?
We don't know.
Another possibility,
is that it's a remnant
from borrowing someone else's homework.
There's evidence
that at least half of the units that we bought
use modified versions of Android
that started off their lives
as Android for Google Pixel phones.
One such image calls itself "BigdroidOS".
The lack of Google results for Bigdroid
seems to indicate that it exists
only for use on Android set top boxes
and could even be an internally developed fork
at a manufacturer of these devices.
Now, we did find BigdroidOS
installed on three different boxes
that seem to come from different manufacturers.
But all three of them
share the same Allwinner SoC model
and the same specs.
And also, we have no way to confirm
that they actually came from different places,
at least not without flying to China
to track the factories down in person,
which is a lot of time and expense
for a throwaway Scooby-Doo reveal bit.
And besides, it doesn't really matter
because we've seen enough at this point
to say definitively
that you shouldn't plug any of these things
into your home network,
at least not without precautions.
I mean, what if we could meddle with the box
and prevent the malware
from getting away with
whatever it's trying to do?
Could we make any of these into useful devices?
Most of them do have 4GB of RAM,
the ability to output in 4K,
Bluetooth, WiFi.
Well, that's a tough one.
Blocking the bad behavior that we know about
won't protect us against the unknown,
and there's a lot that we don't know.
Most of these came pre-rooted
with alternative app stores
and a rebranded version of Kodi.
That does not inspire confidence.
They could easily contain payloads
that target other devices on your local network,
or persistent malware
that steals login credentials.
And no amount of monitoring
is enough to say for sure
that everything has been found and eliminated.
A backdoor in the system, for example,
could lay dormant for months or even years
only to awaken when a bad actor
needs your zombie device to join
a large DDoS attack or something like that.
Now, one option
would be to find a clean ROM
and install it in place
of the stock operating system.
I mean, they are rooted devices after all.
But unfortunately,
our attempts at this
were frustrating at best
and downright impossible at worst.
It seems like all the resellers
that offer fashionable firmware images
are content hosting the files
on Mega, Dropbox or OneDrive.
So if those files expire,
they either don't notice
or they don't care.
And when you do find a ROM
and you figure out
how to flash it onto your device,
odds are good that you will end up
right back where you started,
Core Java folder and all.
Oh, and also,
I mean if you bought this thing
for the pirated content,
that's not gonna survive
a "clean" Android installation anyway.
There does seem to be one project going
to make custom firmware
for Android set top boxes,
but it only works if they have Amlogic SoCs,
and certain streaming apps
are gonna be very limited in functionality
if they work at all.
But hey, you might say,
they're still able to do 4K, right?
Right?
No.
Aside from lagging super badly,
this image is clearly not 4K.
And when we went in with adb
and checked the screen size
being reported by the system,
all of these boxes were either stuck at 1080p
or even 720P which is hilarious
'cause this one says "8K",
not even 4K.
So, do they have any redeeming qualities?
Are they lying about
what's inside the box as well?
Yeah.
Even though this advertises 4GB of RAM,
even though Android reports 4GB of RAM,
and even though the chips on the board
appear to be for a 4GB set
with a searchable part number and everything,
it's not 4GB.
Only half of that will ever be usable,
and the system properties
seem to corroborate that.
This probably explains
why the text on these "Micron" memory chips
look so faded
as though it was cheaply printed at the factory.
This issue is not just limited
to Android TV boxes either,
as some car stereos running Android
apparently also have the fake RAM problem.
Which means that these,
and those,
are all essentially manufactured e-waste.
Unless you know your way around Android very well
and can get a clean image onto yours,
there is nothing to guarantee
that it won't eventually engage
in illicit activities on your network
or try to steal your Google login.
So for just about anyone,
it's not worth the risk.
Especially when these things
cost about the same
as a Chromecast with Google TV,
even the 4K model in some cases.
I mean, sure,
that's not a perfect device either.
Internal storage is limited to 8GB,
a new power brick and dongle is required
to add USB or microSD support,
and it only has 2GB of RAM.
But, come on,
at least it's not Trojan-horsing
its way into your living room
to live across the coffee table
from your stylish lttstore.com throw pillows.
If you want something more powerful,
the Nvidia Shield is definitely that.
Offering up 1080p to 4K upscaling,
regular software updates,
and the ability to act as a Plex media server.
Though it does come
at a significantly higher price.
Both of these alternatives can run Kodi
without too much issue
if that's what you're into.
Both are capable of 4K,
but for real.
And most importantly,
both come free of malware.
We're gonna have links in the description below
if you wanna pick up one of those.
Back to these then.
Streaming services can be really expensive.
Setting up and tweaking
reliable, trusted devices
can be frustrating,
especially if it's for an elderly
or less tech savvy relative.
And I'm not gonna stand here and tell you
to pirate or not to pirate.
I'm just gonna tell you
to practice safe computing,
and this ain't it.
What this is
is a segue to our sponsor, iFixit.
iFixit wants to help you
keep your devices powered
like they are brand new.
iFixit has a wide range
of battery replacement kits
for your mobile devices,
kits for laptops, cell phones,
tablets, smart watches,
and even the Nintendo Switch.
And you don't need to be an expert
to repair your devices.
Each kit has a simple to follow
step-by-step guide
with photos that'll help
walk you through your replacement.
So you can learn a new hobby
while also saving yourself time and money.
Check out iFixit.com/LTT
to find fix kits for your devices today.
If you like this video,
maybe check out our roundup of dash cams,
the "Android TV" boxes of the car.