Google and partners dismantle XCPE, a botnet built into 1.3 million Android devices
Google says a Shenzhen maker shipped Android TV boxes with a hidden backdoor, and it has now cut the maker off and taken down the servers that ran the network.
The short version
- XCPE involved more than 1.3 million Android devices, mostly Android TV set-top boxes.
- Google strongly suspects Shenzhen maker Videostrong Technology Co. put the backdoor into the firmware at the factory.
- Infected devices were used for ad fraud, data theft and relaying unauthorized network traffic.
- Google estimates the takedown cuts attackers off from another 10 million devices.
- Videostrong and any future affiliates are barred from making or selling certified Android devices.
Why it matters
Cheap streaming boxes are easy to forget once they are plugged in, and in this case the compromise reportedly came with the product itself. Buyers cannot spot that by looking at the box, so brand, update support and unplugging unused devices are the practical defenses.
What Google announced
Google said on the 2nd that, working with industry partners, it dismantled a botnet called XCPE. A botnet is a network of hijacked devices that someone controls remotely. This one involved more than 1.3 million Android devices, the vast majority of them Android TV set-top boxes, as infosecu.technews.tw reported.
Google's investigation points at the manufacturer. It strongly suspects Videostrong Technology Co., based in Shenzhen, planted a backdoor in the firmware (the built-in software) before the devices ever left the factory.
What the boxes were used for
According to Google, owners had no idea their devices were being abused. The boxes were used for ad fraud, data theft, and as stepping stones to pass along unauthorized network traffic.
Google described the backdoor and the botnet as deliberately developed, deployed and operated. It also said Videostrong sold access to the backdoor to other criminal partners, who could then install more malicious modules on the infected devices.
Beyond TV boxes
The takedown hit the servers and domains used to control the botnet and send out malicious modules. Google estimates that removing these control points also cuts the attackers' access to another 10 million victim devices, which had been spread across other infection routes and malware families.
Google said the infections were not limited to TV boxes. Traces turned up on Android-based internet-connected devices including telehealth equipment, karaoke machines and digital signs.
Consequences for the maker
Google has ended its relationship with Videostrong. The company and any future subsidiaries or affiliates are banned from making or selling officially certified Android devices, and from providing software services to other certified manufacturers.
Google also said the case has led it to review and adjust how it vets device makers, aiming to prevent similar supply-chain problems. A supply-chain risk means a product is compromised before it reaches the buyer.
What to watch
- Whether boxes already in homes get cleaned or remain compromised, which the reporting does not say.
- What changes Google makes to its vetting of Android device manufacturers.
- Whether Videostrong responds to Google's allegations.
Try it
List the streaming boxes and smart-TV add-ons in your home or office, unplug any you no longer use, and check that the rest are from a known brand and still getting updates.
Sources and links
Liked it? Say why
Add a line for other readers.
No account needed. We never show your email. Comments with links, ads or abuse are held and not shown. Your comment shows after a quick check.
Listen to the AI Wire headlines
Listen to the AI WireListen to our daily AI shows every morning: on your commute, in the shower, wherever you are
Listen to the daily showsFirst reported by infosecu.technews.tw · Read the original. Written by the SI Agent News Desk from the reporting above.Written with AI from the source above. Every number is checked against the source. Spot a mistake? Corrections.