Google and industry partners have dismantled XCPE, a backdoor that turned more than 1.3 million Android TV boxes into a botnet, a network of devices remotely controlled by malicious actors. According to Google, the backdoor was intentionally installed by Shenzhen-based manufacturer Videostrong Technology, which then sold access to criminal affiliates.
The botnet was active in more than 200 countries, according to one of the sources. The backdoor was already in the device firmware when the box was bought: once connected to the home network, the device began obeying remote commands. The firmware included a management agent that presented itself as a standard remote-management client, pulled updates from a GitHub page and connected to an MQTT server, a messaging system that let the operator install and remove apps, change settings and push updates.
Affiliates used the devices for ad fraud, to turn home connections into residential proxies that route other people's traffic through a victim's connection, and to install further malware. According to TrendAI, numerous links to the operation were documented between June 3 and October 1.
The coalition also disrupted the command-and-control domains used to manage the affiliate modules. Google estimates that at least 10 million additional compromised devices were cut off, infected through channels other than XCPE, including set-top boxes, karaoke machines and telehealth hardware.
Google has ended its relationship with Videostrong, revoked its license to preload Google apps on its devices, and barred the company and its future affiliates from producing certified Android devices. The backdoor remains on boxes already sold, and owners cannot remove it themselves. Videostrong did not respond to requests for comment.
No comments yet. Be the first!