Black Friday Android: Bright-Tab 9'' from Runnings

[cpd2009]

Black Friday in the USA brings to mind three things... Crowded malls, [strike]people politely purchasing[/strike] people shoving, pushing and punching each other for that big doorbuster deal, and low-end no-name Chinese electronics. Such electronics typically are cheap Android tablets, cheap Bluetooth speakers or headphones, cheap no-name TVs, and so on. I'm interested in the cheap Android tablets myself. They have become so prevalent, stores that usually never sell tablets suddenly stock them for Black Friday. In my state, Macs Hardware and Runnings Farm & Fleet featured the "Bright-Tab" for $59.99



I initially resisted purchasing this tablet, but no reviews for the 9'' variant could be found. Reviews for an older 7'' model were on Amazon. In the end, I decided to purchase the Bright-Tab.



The main specs of the Bright-Tab are an Allwinner A33 Quad-Core CPU with a Mali-MP 400 GPU, 512mb RAM, 16gb Storage, 0.3MP front and rear cameras, 800x480 TFT LCD capacitive touch screen, and running Android 4.4 KitKat. These are typical specs for a budget Android tablet from China, though such tabs are typically found online and not in a physical retail store.

The tablet's Android 4.4 OS is mostly stock, with very little in the way of bloatware besides a weather widget on the home screen. Google Play and all the various Google apps come pre-installed and you view movies and pictures with the "UHD Player" application. There is an "Update" application which I presume updates the OS, but it's broken. First time I tried it, it failed to connect to it's server. Second time, the application crashes as soon as you check for updates. So far, I have tested general web browsing with Dolphin, and with the limited RAM, complex pages can become slow and laggy. Game performance seems good. I tested Angry Birds and Jewels Star and both run fine. Sonic Dash is listed as being incompatible by the Google Play store perhaps due to the low amount of RAM. Granted, I need to use the tablet for a week or so to get a better idea on how the tablet would perform with long browsing sessions or gameplay. I plan on doing so. The LCD screen quality is noticeably lower than Pumpkin thanks to using cheaper TFT technology. As such, the viewing angles are rather poor. Turning the tablet sideways too far causes the image to fade into a bright whiteness that perhaps is why the tablet bears the name "Bright-Tab". (I know, bad joke)

The build quality of the Android tablet is alright. Compared to Pumpkin, my RCA Maven Pro 11 inch tablet, the plastic does feel cheaper and lighter. It's not horrible though as it doesn't feel like it will shatter in your hands. There is a standard headphone jack, a DC input jack, a MicroUSB port, and a MicroSD slot. I don't know why the DC input jack is present as the included wall adapter is MicroUSB.

I now present a series of screen captures of benchmarks I ran on the BrightTab. I tried running my usual goto benchmark, AnTuTu. It kept restarting after the tests finished and I didn't get my device score. I used PCMark and Geekbench 3, and I also ran the benchmarks on Pumpkin to compare with. After the test screenshots, I will share camera comparisons, and I will post a rather surprising thing about the BrightTab. Now, the screenshot parade....

[cpd2009]

First up, Pumpkin's scores in PCMark Android and Geekbench 3...

[cpd2009]

And now, the scores from BrightTab using the same programs:

[cpd2009]

To show off the camera performance properly, I have decided to upload the images without compression or resizing. Thus, the images may take a bit to download if you are on a slow connection. Pumpkin's camera is first, followed by the BrightTab.

[cpd2009]

And now, the big surprise about the BrightTab...

The BrightTab might have shipped with Malware.

For whatever reason, I decided to run Sophos mobile antivirus, and it detected a trojan called "Android/Trojan.Coudw.A". I then ran Malwarebytes AntiMalware, and this is what it brought up...


Apparently, the BrightTab has a preinstalled trojan called "Cloudsota." This mainly starts pushing ads in your face through popups, replacing the boot animation with ads, changing your browser homepage to ads, and even going so far as to uninstall anti-malware apps without your permission. It also has the potential to make your tablet unusable by printing a very large red "Demo" text on the Android UI, and it won't go away no matter what you do. More info is below....
<!-- m --><a class="postlink" href="http://www.cmcm.com/blog/en/security/2015-11-09/842.html">http://www.cmcm.com/blog/en/security/20 ... 9/842.html</a><!-- m -->

Normally, you only get such infected tablets online through eBay or Amazon, but the BrightTab was a Black Friday special in a physical retail store. I don't know how many of these tabs reach the sales floor, but perhaps this is one of the rare occurrences that it has.

And, I ran Malwarebytes on Pumpkin, and he came out clean...


I may have to end up doing some anti-malware work on the BrightTab, and perhaps even flash it with a new firmware if the possible trojan is embedded into the Android build itself. I wonder if I should email Runnings corporate office or even Cheetah mobile security about my finding. There is possibility that hundreds of these tablets flew off Runnings shelves to give as Christmas gifts. :/

[huckleberrypie]

Lulz at the RCA tab smoking the Bright Tab when it comes to battery life. I am yet to get more than an hour's worth of battery life with mine when it comes to continuous wifi browsing with my Kingcom tab, not to mention that it heats up like a stovetop whenever I throw intensive tasks at it like games.

As for malware, here's hoping Homeland Security won't go paranoid and ban the sale of these tabs outright without discretion. You can try getting rid of it through either of the two utilities Stephan made:
<!-- m --><a class="postlink" href="http://www.techknow.one/forum/index.php?topic=9212.0">http://www.techknow.one/forum/index.php?topic=9212.0</a><!-- m -->
<!-- m --><a class="postlink" href="http://www.techknow.one/forum/index.php?topic=8572.0">http://www.techknow.one/forum/index.php?topic=8572.0</a><!-- m -->

Cloudkiller requires root, but I assume the tablet you're using may have been pre-rooted as in the case of mine.

[cpd2009]

Lulz at the RCA tab smoking the Bright Tab when it comes to battery life. I am yet to get more than an hour's worth of battery life with mine when it comes to continuous wifi browsing with my Kingcom tab, not to mention that it heats up like a stovetop whenever I throw intensive tasks at it like games.

As for malware, here's hoping Homeland Security won't go paranoid and ban the sale of these tabs outright without discretion. You can try getting rid of it through either of the two utilities Stephan made:
<!-- m --><a class="postlink" href="http://www.techknow.one/forum/index.php?topic=9212.0">http://www.techknow.one/forum/index.php?topic=9212.0</a><!-- m -->
<!-- m --><a class="postlink" href="http://www.techknow.one/forum/index.php?topic=8572.0">http://www.techknow.one/forum/index.php?topic=8572.0</a><!-- m -->

Cloudkiller requires root, but I assume the tablet you're using may have been pre-rooted as in the case of mine.

Yep, the Bright-Tab was rooted straight out of the box, and that means I can use tools to remove the Cloudsota malware. I scanned with Malwarebytes and the malware was confirmed to be toast. It worked.... until I rebooted, when the malware was re-installed and Malwarebytes detected it once again.

More aggressive measures must be undertaken, but it's getting late here. Tomorrow should be a good day to get rid of it for good.

Still, the others who bought this tablet probably have no idea they come with this malware and will likely get angry at Runnings when their tablets start spewing pop-up ads and whatnot. :/

[huckleberrypie]

Alright, check your Facebook inbox. Just sent a firmware dumper to you which should help out in getting rid of that malware. What fsebentley and I are thinking is to dump the ROM, edit it to remove the offending code, rebuild it using a ROM that closely matches the one on yours, and then have you flash the new software.

[cpd2009]

Alright, check your Facebook inbox. Just sent a firmware dumper to you which should help out in getting rid of that malware. What fsebentley and I are thinking is to dump the ROM, edit it to remove the offending code, rebuild it using a ROM that closely matches the one on yours, and then have you flash the new software.

I was very close to throwing in the towel, but after getting the ROM dumper to work (which involved placing it in my ADB installation folder), I have the ROM compressed, and it's now being uploaded to my private file server. It's about 750mb, so it's taking a bit to upload. It would have been done by now if I didn't end up closing the upload tab by accident earlier on. >.<

Once the ROM is sent off to you, you can work your magic.

[cpd2009]

The ROM has been successfully sent, and as me and Blake suspected, the ROM is tainted with the CloudsOTA malware. It's embedded inside boot.img, so if you remove it from the system partition with various tools, it will restore itself upon reboot. The recovery image is tainted with the malware as well, so both will have to be sanitized and rebuilt.

In the end though, the device will be free from malware and I can add it as a secondary tablet to Pumpkin. Makes me wish I had the time to learn how to cook my own Android ROM....