Someone I know has one of these.
KD1:/ $ pm list packages | grep cpe package:x.cpe KD1:/ $ settings get global package_verifier_user_consent 1Hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm, so Play Protect is enabled and doing nothing about it. Also, “nexus” wasn’t installed, not here at least. Not “system.ntp”, “oemservice” or “sso” either.
com.droidlogic.*is just generic AmLogic crap, if there’s a backdoor in there it’s probably a different company. The Google article mentionslibexploit.so, which doesn’t exist with a quickfind. Neither doeslibjaguar.so.libbase.sois just a generic file present everywhere, nothing interesting instringsfor it. My guess is that it’s geographically locked.So I am not sure what I am supposed to do with that. I just ran
pm disable-useron it, hopefully that’s enough.Videostrong’s compromised boxes, mostly sold under the MECOOL brand
com.oemservice
com.android.carrierconfig is that you?
Google certified the boxes, the manufacturer installed a backdoor, and 1.3 million customers got an involuntary side hustle as residential proxies. Now the botnet is disconnected, but the malware remains and Play Protect is still disabled. Apparently »certified« just means the box passed inspection before it started spying.
Manufacturer: “here you go” 💰
G: lgtm ✅
How do I read “lgtm”? Legitimate?
“Looks good to me.” It’s a standard phrase used when signing off on changes.
Thanks. As an ESL, somehow I never come across that short form despite being online as a teenager since the 00s.
I always thought it meant “Let’s get this merged”! 😆 Turns out I read this wrong for years.
I’ve been looking for a box to replace my Chromecast for a while now but was hesitant for precisely this reason. At some point I even looked at the MECOOL boxes. Good my paranoia prevailed. Still looking for an TV box though. Any suggestions?
This might sound silly, but I ended up just hooking up my PC to the TV via HDMI. I just have a wireless mouse and keyboard and it can do all the things
google doesnt like others cutting in thier own business.
Of course LTT was hawking this stuff for a buck.
He’s gotta pay for his private jet somehow
my android TV device isn’t google certified and I run a VPN with an adblocking DNS on it. I stream HD video with it whenever I have it on, what should I be looking for if I have a bad one?
arstechnica linked to this location to identify if you have a model/package that is infected. It’s a looooong list.
If I get this right, fireTV sticks are not in there?
No, amazon monopolizes the privacy invasion for their devices.
I see where you are coming from, and I agree that amazon shits on privacy. But this is another level compared to “only” spying on your users. From the article:
After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator’s behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious.
Oh I completely agree. Also I don’t doubt those other boxes were also invading peoples privacy.
Nah. Mine’s not on there
