Hacker News Reader

DesktopECHOon XRDP with H.264 codec brings immense performance boost

If anyone on Windows would like to see what performance is like, I updated my WSL installer scripts to use this version of XRDP.

Ubuntu XFCE: https://github.com/DesktopECHO/xWSL

KDE Neon: https://github.com/DesktopECHO/kWSL

Kali: https://github.com/DesktopECHO/Kali-xRDP

These scripts will build a complete RDP-accessible Linux desktop environment in WSL. A GPU isn't needed to see a significant performance gain over 'stock' XRDP.

DesktopECHOon XRDP with H.264 codec brings immense performance boost

I don't see anything with regards to inclusion of the Clear Codec (RDP8.1 + H.264) in Fedora builds.

If there is evidence indicating this is actually the case, please let me know.

DesktopECHOon XRDP with H.264 codec brings immense performance boost

That's client side. FreeRDP needs H.264 libraries to work with this branch of XRDP. Apparently, Ubuntu and variants do not include this in their FreeRDP builds, good to know it's in Debian though.

(MSTSC.EXE and the official macOS RDP client already have H.264 support built-in)

DesktopECHOon XRDP with H.264 codec brings immense performance boost

I believe your writeup is about enabling Glamor; it does not do anything to enable the H.264 "Clear Codec" branch of XRDP.

Apologies in advance if I'm wrong here, please correct me if I'm mistaken :)

DesktopECHOon The situation with malware on Android TV ROMs is ridiculous

https://github.com/DesktopECHO/T95-H616-Malware#25-apr-2023-...

> Thanks to Tanner at LTT for letting me review his findings - It appears the scope of this issue is much bigger than expected; many Android TV Boxes with the AllWinner H616, H618 and RockChip RK3328 feature the "Corejava" C2 Bootstrap.

DesktopECHOon T95 Allwinner T616 Malware Analysis

Not this one.

> Nope. While basic Linux support is slowly materializing, two major blockers are still at the same spot - HDMI audio (no useful driver) and bug in display driver (big code change may be required to fix it).

https://forum.libreelec.tv/thread/24275-allwinner-h616-suppo...

DesktopECHOon T95 Allwinner T616 Malware Analysis

Clearly you never saw the original title before it was changed by the mods, but believe whatever you like.

DesktopECHOon T95 Allwinner T616 Malware Analysis

Wow sorry to hear that. If you can, check if the device is still available over ADB. If it is, try re-running the script.

Not sure what happened in your case, I flashed many ROMs and ran the script against them to see if anything bad would happen. No issues.

In any case it won't be a Hard Brick. Power off, hold [volume-up] insert power jack and tap the [power] button 10 times. (I think. I lost my remote ages ago and can't check.)

DesktopECHOon T95 Allwinner T616 Malware Analysis

I'm with you on that. There are efforts underway to get plain-old Linux running, but it's some time away as this chip only went into mainline as of kernel 6.0

DesktopECHOon T95 Allwinner T616 Malware Analysis

I'm not going to try and change your mind, just sayin' that seems like a really bad idea.

DesktopECHOon T95 Allwinner T616 Malware Analysis

Thanks for this fascinating insight. The jankyness you describe lines-up exactly with what I'm seeing here.

If H616 was the mainstream/volume chip box to have in 2021, then I'm super-interested to see what their 2023 H618 boxes look like. They are all over Amazon with loads of reviews on YouTube, just like its predecessor.

Considering the interest this write-up has generated I'm inclined get one and 'take the bullet' to see if this behaviour is continues. Given your insight about how these chips get sold, chances seem quite high.

DesktopECHOon T95 Allwinner T616 Malware Analysis

These boxes identify themselves as a Google Pixel 2 (walleye) because, reasons!

DesktopECHOon T95 Allwinner T616 Malware Analysis

I'm not too surprised, as the malware goes out of its way to use ycxrl.com -- Going to extents like using 8.8.8.8 instead of the default DNS server, and trying a DNS server on port 5353.

Using those techniques, nobody would get a chance to see this second fall-back.

EDIT to clarify: Thanks for listing this, it's definately good to list these addresses as 'bad' for others to be aware, but DNS blocking won't slow down this malware, not even a bit.

Here's what it took for me to see cbpheback.com -- Install Pi-hole on the Android device and add these rules to iptables:

  adb shell iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p tcp --dport 5353 -j DNAT --to 127.0.0.1:53
  adb shell iptables -t nat -A OUTPUT -p udp --dport 5353 -j DNAT --to 127.0.0.1:53

DesktopECHOon T95 Allwinner T616 Malware Analysis

Title was changed by the mods so that's how it stays! :)

DesktopECHOon T95 Allwinner T616 Malware Analysis

Thanks for the guidance here. Where I'm really stuck is when tcpdump tells me about the presence of the offending traffic and correlating process. In this case, it's the Android "system_server" process and I'm not sure how to find the hook into it that downloads the malware.

In hindsight I should have made this an Ask HN post...

DesktopECHOon T95 Allwinner T616 Malware Analysis

Funny you mention it, as it also had ADUPS. By itself, I can deal with that.

Actually it more resembles the CopyCat malware. My challenge is finding the hook in system_server that downloads the payload from C2.

* https://www.checkpoint.com/downloads/resources/copycat-resea...

DesktopECHOon T95 Allwinner T616 Malware Analysis

Fair point, thanks. Added AliExpress.

DesktopECHOon T95 Allwinner T616 Malware Analysis

Yeah only the primary server seems to be on blocklists. The malware uses 3 DNS addresses, all on Linode.

Not that it matters, as the malware uses 8.8.8.8 if it doesn't like the DNS reply -- Then it tries a DNS server on port 5353!

DesktopECHOon T95 Allwinner T616 Malware Analysis

Follow-up to my earlier report about the stock firmware on these Android TV devices, with a script to de-fang Stage 0 by preventing the payload from downloading (chattr +i FTW!)

DesktopECHOon Repurposing an old Android phone as a web server

I went the Linux Deploy route and published a couple of container images that Just Work on pretty much any ARM Android device.

Once you shiv systemd, some pretty elaborate scripts can run in an Android chroot just like they would on bare-metal ARM. Just think of your old Android as an off-brand rPi with case, built-in touchscreen LCD, and way, way fewer GPIO pins. No surprise the server will need a new UPS battery.

NextCloudDroid: https://github.com/DesktopECHO/nextcloudpi Pi-hole for Android: https://github.com/DesktopECHO/Pi-hole-for-Android

DesktopECHOon I must announce the immediate end of service of SSLPing

https://sslping.com/

This site can’t provide a secure connection

sslping.com sent an invalid response. ERR_SSL_PROTOCOL_ERROR

/Ironic

DesktopECHOon Ask HN: How to navigate USB-C charging hell

> Long story short, I built a new threadripper workstation, and none of the gazillion of USB port will charge my One Plus 5T phone.

Sounds to me like your PC is busted.

DesktopECHOon [dead]

Pi-hole for Windows is a batch file that performs an automated install of Pi-hole 5.x on Windows 10 (v1809 and newer) or Windows Server 2019 (Core/Standard)

PH4WSL1.CMD is unique in that it uses WSL1, not virtualization or containers, and is extremely easy to set up.

It needs a fraction of resources compared to other 'virtual' rPi appliances and runs on older CPU's without VT support, or on a VPS that doesn't pass-through virtualization support. For example it runs well on an old laptop with 1 CPU core and 2GB of RAM; consuming an imperceptible amount of host OS resources.

It can be used to block ads on your entire network but real/dedicated hardware is probably a better idea in that situation. Its ideal use is for ad-blocking on-the-go instead of needing to manage a HOSTS file on your laptop, or to have a look at Pi-hole's feature set before committing to a hardware purchase.