[Android TV General] sjustinas:
Yesterday, I noticed my Dynalink 4K Box struggling with 4K video. After running "top" in "adb shell", I found a strange process named "askey_tr", running as root (!), occasionally pegging the CPU at 100-200%.

I decided to dig around and in the end was so spooked (and annoyed with the performance drop) that I ended up rooting my device and removing this binary with a DIY Magisk module. Here's what I found by running "strings" on the binary.

It seems to include help strings for common unix tools like ping and traceroute:

Modern traceroute for Linux, version 2.1
Copyright (c) 2016 Dmitry Butskoy, License: GPL v2 or any later
You do not have enough privileges to use this traceroute method.
ping: can't set multicast time-to-live

This would've almost fooled me (maybe "tr" in askey_tr stands for traceroute, right?), however, it gets more interesting after you look more. There are references to something called TR069:

external/tr069/source/atomic.c
external/tr069/source/sd.c
external/tr069/source/ft.c

Googling revealed that TR069 is a protocol for remote management of consumer devices, including set-top boxes. That would make some sense. There is even a paper describing use of TR069 for Android devices. However, the unknown extent of this type of "management" scares me. Wouldn't Android's standard update mechanisms be enough?

There are also some strings that look like metrics about the device:

Device.DeviceInfo.ProcessorNumberOfEntries
Device.DeviceInfo.SupportedDataModel.1.URN
Device.DeviceInfo.ProcessStatus.ProcessNumberOfEntries
Device.ManagementServer.ConnectionRequestUsername
Device.ManagementServer.STUNUsername
Device.ManagementServer.StandbyPolicy.NetworkAwarenessCapable
Device.UserInterface.PasswordRequired
Device.UserInterface.ISPName
Device.UserInterface.RemoteAccess.X_Charter_AllowedIpRanges
Device.Ethernet.RMONStats.template.DropEvents
Device.Ethernet.Interface.2.Enable
Device.Ethernet.Interface.2.Stats.BytesReceived
Device.Ethernet.Interface.1.Enable
Device.Ethernet.Interface.template.LowerLayers
Device.Ethernet.Interface.template.Stats.BytesReceived
Device.Ethernet.Link.2.Stats.DiscardPacketsSent
Device.Ethernet.Link.1.Stats.UnicastPacketsSent
Device.Ethernet.Link.template.Stats.BroadcastPacketsSent
Device.Ethernet.Link.template.Stats.BroadcastPacketsReceived
Device.Ethernet.VLANTermination.template.Stats.BroadcastPacketsReceived
Device.SoftwareModules.ExecutionUnit.template.Status
Device.SoftwareModules.ExecutionUnit.template.References

Things related to XMPP protocol:

ctrl_send_sig ctrl_sig_xmpp_status_changed
jabber:client
xmpp_load_pem_cert

And some other things that give us clues: HTTP request templates, symbols from OpenSSL, etc.

I also tried to drop this executable into Ghidra, but felt way out of my depth as I'm not experienced in reverse engineering. Perhaps this will pique the interest of someone more skilled.

So in conclusion, this may be something as benign as a software for delivering OTA updates, or a full-on backdoor. The troubling part is it running automatically as "root" and the fact that its nature is not documented anywhere.

I'm attaching the binary and a zip of the contents of /data/tr069 where the executable seems to store its data.