Google says it has disrupted XCPE, a botnet of more than 1.3 million Android TV set-top boxes that were backdoored before they left the factory, and has banned the Chinese manufacturer it holds responsible from its certified Android program, BleepingComputer reported Monday. The case shows how cheap streaming boxes can become infrastructure for fraud and intrusions, including on the home networks that remote employees use for work.
What Happened
Google's Threat Intelligence Group said it took legal action to take down the domains and servers that Videostrong Technology Co., a Chinese Android device maker, used to control the botnet and push more malware to it. The action also targeted command servers for more than a dozen malware families loaded through the backdoor. Google's account does not name a court or describe the filing.
Google said it assesses "with high confidence" that Videostrong built and ran the backdoor for profit and sold access to criminal affiliates, and that the campaign was not the work of a rogue insider or a development oversight. None of the outlets that covered the takedown reported a response from Videostrong.
The backdoor sat in the device firmware, the software built into the hardware, and ran with system-level privileges, according to BleepingComputer. It let operators install apps silently, switch off Google Play Protect, Android's built-in malware scanner, run commands, capture screenshots, inject keystrokes and open remote access. Affiliates loaded residential proxy software, which routes strangers' internet traffic through the infected device, along with ad-fraud tools and more backdoors.
Google estimates that cutting off the affiliates' command servers will sever access to at least 10 million more compromised devices infected through other channels, including retail set-top boxes, karaoke machines and telehealth hardware, BleepingComputer reported. Partners included Japan's National Police Agency and the security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Google ended its relationship with Videostrong and barred it and any future affiliates from making certified Android devices or supplying software to certified vendors. Google said the company hid code that loaded after a device's first boot to slip past certification testing, and that it has changed its review process and is improving firmware integrity checks.
Why It Matters
Residential proxies let criminals disguise password-guessing, fraud and intrusion attempts as ordinary household traffic, which undercuts defenses that block suspicious internet addresses.
Security teams should keep uncertified streaming boxes and similar consumer gadgets off corporate networks and encourage staff to separate them from work equipment at home. Google advises buying set-top boxes only from manufacturers on its certified Android TV partner list.
Context
Synthient found Videostrong's malware preinstalled on a MECOOL box sold by Skyworth, Krebs on Security reported; Synthient founder Ben Brundage told the outlet the 1.3 million count was "highly conservative." CyberScoop reported, citing TrendAI researchers, that the botnet spanned more than 170 countries. It also reported nearly 44,000 infected devices in the U.S. between June and October.
The Primary Wire reported in October, citing BleepingComputer, on proxy and ad-fraud malware that Bitdefender found built into the firmware of low-cost Android phones.
What to Watch
The takedown does not clean infected boxes. BleepingComputer reported that the malware reinstalls itself from a protected part of the device's storage if removed, so owners need clean firmware or must disconnect the device. Watch whether retailers delist Videostrong-made products, as Google urged, and whether Videostrong responds.
