Google and its partners have shut down XCPE, a botnet that ran on more than 1.3 million Android TV boxes. Google says the device maker built it in on purpose, its Threat Intelligence Group wrote in a blog post on Monday.
“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users,” Google wrote.
The maker is Videostrong Technology, a Shenzhen company that builds Android TV boxes and other devices. Google said it has high confidence that Videostrong developed and ran the backdoor for profit, and sold access to criminal affiliates. It found the code in many device models and brands over several years.
“We believe this campaign wasn’t an isolated rogue insider or a development oversight,” Google wrote.
Google has cut ties with Videostrong. It banned the company, and any future subsidiaries or affiliates, from building certified Android devices or supplying software to other certified makers.
What the backdoor did
The backdoor, x.cpe, sits in the firmware with system-level access and reinstalls itself if a user deletes it. It turned off Google Play Protect, Android’s built-in app scanner, so it could install apps without the owner knowing.
Videostrong then loaded its affiliates’ modules onto the boxes. Most turned them into residential proxies. These rent out a home’s internet connection, so other people’s traffic looks like it comes from an ordinary household. Others faked views of online ads.
Google said it also saw Videostrong’s operators take live screenshots, inject keystrokes and copy account details and system logs. The backdoor could map the home network a box sits on. LG said in September that its smart TVs scan home networks and that every smart TV does.
Most infected devices were set-top boxes. The backdoor also turned up on telehealth devices, karaoke machines and digital signage.
Germany and the UK among the targets
Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. It used legal action to take down Videostrong’s control servers. It also took down the control domains of more than a dozen malware families loaded through the backdoor. Google expects that to cut criminals off from at least 10 million more infected devices.
The takedown came weeks after Microsoft disrupted Chinese-language phishing kits behind 1bn scam messages.
TrendAI, Trend Micro’s enterprise business, counted 1,472,554 infected devices across 206 models between June and October. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The US, Germany, the UK, Australia and Canada each had about 26,000 to 42,000.
A gap in Google’s tests
Videostrong was a certified Android maker, which means its devices go through Google’s compatibility and security tests. Google said Videostrong hid its code to exploit “a gap in our tests” and loaded it after a device’s first boot. Google has changed its review process and is improving its firmware checks on certified Android TV devices. The gap surfaced weeks after Google added Gemini scam checks to Android calls and Messages.
On 2 November, Videostrong’s website still listed products it called “Google Certified Android TV Box”, The Hacker News reported.
The takedown cuts the operators off, but it does not clean the boxes. TrendAI said owners cannot remove the backdoor themselves, because it runs as a system app signed with the maker’s key. Synthient, which links the MECOOL brand to Videostrong, has published a list of 182 model names seen in the campaign. It warns that a model name alone does not confirm a box is infected.