Suspicious network activity

[dillyhammer 3]

Suspicious network activity

Greetings,

Every 5 seconds, my MyGica 1800 box is making a request to the domain "aps.amap.com".

Does anyone have any clue what causes this. The reason I ask is, that request also causes a small hiccup on any movie I'm watching via the network connection to my NAS. It's getting very annoying. I have this sickening feeling my box has been compromised somehow.

Any help or hints would be very appreciated.

[dillyhammer 3]

Just as a follow up I got quite nervous following some research that indicated the aps.amap.com domain was associated with malware. There's a thread here indicating there's been significant progress with lollipop on the 1800e, so following someone's advice I unplugged my network cable from my box and performed that upgrade that included the full system factory refresh. It was a flawless upgrade, and Google Play also performed the Kodi 17.0 upgrade flawlessly.

I do note that if you attempt to exist Kodi while it is scanning the system seems to hang. Or at least takes too long to go back to the Home screen. Power cycle is required. Also, in the About area my 1800 shows up as a 1900AC.

Anyways.... it goes to show, you have to be careful when installing add-ons. These boxes are vulnerable if you 're too trusting with your add-on sources. Best to do your homework beforehand, as opposed to after the fact like me.

Justin, nice work on 5.1 for the 1800. Aside from the gotchas mention above, my system seems very stable and performs well.

[dillyhammer 3]

Yeah. I spoke too soon.

So, wired ethernet is really screwed up. I get random disconnects and the MAC address is changing every reboot. My router thinks the network is being attacked. 

Switching to wireless seems to fix the problem.

Playing certain HD movies now crashes Kodi.

I'm 30 second away from dropping this box into the river and buying something else. I'm so sick of this.

[Justin 206]

3 minutes ago, dillyhammer said:

Yeah. I spoke too soon.

So, wired ethernet is really screwed up. I get random disconnects and the MAC address is changing every reboot. My router thinks the network is being attacked. 

Switching to wireless seems to fix the problem.

Playing certain HD movies now crashes Kodi.

I'm 30 second away from dropping this box into the river and buying something else. I'm so sick of this.

If you think you have malware issues it might be from an app you installed

Have you tried factory resetting the box and reinstalling kodi etc?

[dillyhammer 3]

17 hours ago, Justin said:

If you think you have malware issues it might be from an app you installed

Have you tried factory resetting the box and reinstalling kodi etc?

I upgraded the box from 4.4 to Lollipop instead of the factory reset. I figured if I was going to go through the pain of a factory reinstall, might as well try and get the box more current.

At first it appeared the upgrade was solid, but after a few hours of using the box I've discovered some flaws.

The MAC address on the wired connection changes frequently for no apparent reason. That is extremely unusual. Others appear to have experienced this issue after upgrading to Lollipop. I've resorted to using wireless, which I am not fond of, but it appears to be working fine even with higher end video files with huge bitrates. At first I thought this was due to updating Kodi to Krypton via the Google Play store, but after a factory reset and back to Jarvis 16.1 the issue persists.

That wired NIC interface/driver seems to be causing a lot of issues. I understand the upgrade process hangs if a cable is connected to the wired NIC. I can't confirm this as I read that from another user here so unplugged mine before attempting the upgrade. 

I have experienced other issues as well. For example, in Kodi (Jarvis 16.1 stock that came with the upgrade or Krypton), if I select anything other than 2 channel audio output in settings and then attempt to play any video containing more than 2 channels, Kodi hangs. Power cycle is the only fix for that, it locks up tight.

So I have audio output set to 2 channels and the wired ethernet disconnected, using wireless. 

I understand these updates don't always go perfectly, but stable networking and multi-channel audio are core features. Without those, the value of this box is marginal. Knowing what I know now, I would not have done the upgrade. Hopefully there will be a fix for the NIC situation sooner rather than later. How it goes with the audio... we'll have to wait and see I suppose. I spent 6 hours struggling with all this stuff yesterday. That lost time cost me more than I paid for this box. Not. Happy.

[dillyhammer 3]

If I power off the box by simply hitting the power button on the remote, if I power the unit back up by hitting the power button on the remote again, thew box is dead. No output to the screen whatsoever.  Power cycling by removing the power supply is the only fix.

This unit is toast - it's no longer usable.

Is there instructions anywhere for downgrading back to android 4.4?

[dillyhammer 3]

I'm going to use the file here:

I think that one gets me back to a factory reset to KitKat 4.4 and Kodi 16.1.

 

 

 

[dillyhammer 3]

My ATV 1800E has been restored to  KitKat 4.4 and Kodi 16.0.

This is where I was at before I my suspicions of a compromise. It goes to show you have to be very careful where you install plugins and add-ons from. I think I'll just be sticking with the tried-and-true stuff from community-supported repos.

Frankly, I don't think this box is juicy enough to run Lollipop. And that's not a knock on the box, it is what it is and does what it was designed to do when it first came out. I think people who own this box should just stick with KitKat and Kodi 16. It's reasonably stable and "as advertised" when using that software.

Thanks Justin, for those KitKat 4.4 and Kodi 16.0. Factory Files. I'm back to being a happy camper with my unit.