Google disrupts XCPE botnet affecting over 1.3 million Android TV boxes

Google and industry partners say they have disrupted the XCPE botnet, which affected more than 1.3 million Android TV streaming boxes. Google attributes the operation with high confidence to Videostrong Technology Co., alleging that the manufacturer deliberately installed a persistent backdoor in devices it made and sold access to criminal affiliates.

Google says affiliates used infected devices for ad fraud, as residential proxies, and to install additional malware. The company also took down XCPE command-and-control servers used by more than a dozen related malware families, cutting off access to at least 10 million other compromised devices. Those devices, which were compromised through other means, included retail set-top boxes, karaoke machines, and telehealth hardware; Google says not all were Android devices.

Google terminated its relationship with Videostrong, revoked its license to make Android TV devices with preloaded Google apps and services, and barred the company and future affiliates from producing certified Android devices or supplying software to certified vendors. Google says the botnet’s backdoor was built into device firmware during manufacturing. It also changed its certification review process after finding that Videostrong used obfuscation to evade security testing and load malicious code after devices first booted.

The disruption involved Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient, and TrendAI. In a report published Monday, Google’s Threat Intelligence Group said it assessed with high confidence that Videostrong developed, deployed, and operated the backdoor and botnet for financial gain.