More than 1.3 million devices were enrolled in the XCPE botnet through a backdoor that may have been pre-installed on consumer electronics, according to a Google Threat Intelligence Group report. Google and industry partners disrupted the network last week and said they had high confidence that China-based manufacturer Videostrong Technology Co. developed and operated the malware for financial gain.
The backdoor, identified as x.cpe or com.oemservice, was built into firmware on Android TV set-top boxes and other Android-based hardware. It ran with system-level privileges and could reinstall itself from the firmware partition if a user tried to remove it. Android TV boxes made up most of the infected devices, though the malware was also found on telehealth devices, karaoke machines and digital signage equipment.
Videostrong reportedly sold access to compromised devices to criminal affiliates. The affiliates used additional software for ad fraud, enrolled devices in residential proxy networks that sold their bandwidth, and distributed other malware. The botnet’s components changed over time, with later versions using MQTT for command and control and adding privilege-escalation and anti-analysis capabilities.
Google took legal action to seize domains and servers used by Videostrong and disrupted infrastructure associated with more than a dozen affiliate malware families. The company also barred Videostrong and its future subsidiaries or affiliates from building or supplying software for certified Android devices. Google said the action is expected to cut off access to at least 10 million additional compromised devices reached by affiliates through other channels.
The operation involved Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google also strengthened firmware integrity checks for certified Android TV devices. However, the company has not released a full list of affected models, and the backdoor remains in the firmware of devices already in circulation.
Because the malware was installed during manufacturing, owners of low-cost, uncertified boxes may have no straightforward way to identify or remove it. Infected devices could disable Google Play Protect, take screenshots, run shell commands and route network traffic without visible signs. Google recommends buying from certified Android partners and enabling available security protections.
Sources: Cord Cutters News.