Google Dismantles XCPE Botnet of 1.3 Million Android TV Boxes

Google and industry partners dismantled the XCPE backdoor last week, a botnet that enrolled more than 1.3 million Android TV set-top boxes, the company said Monday.

What happened

Google said it assessed with high confidence that Videostrong Technology Co., a China-based Android original equipment manufacturer and original design manufacturer, intentionally developed, deployed and operated the backdoor for financial gain. Videostrong monetised the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices, Google said. Those secondary modules conducted ad fraud, silently enrolled devices into residential proxy networks and loaded additional malware.

Google also took action to disrupt the command-and-control domains that operate those affiliate modules. Because the affiliates have diversified distribution channels beyond XCPE, Google said the takedowns would sever access to at least 10 million additional compromised devices.

Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI to analyse the malware ecosystem and disrupt its operations. The company took legal action to take down the domains and servers Videostrong used, banned Videostrong and any future subsidiaries or affiliates from building or selling certified Android devices, and said it implemented changes to its review process to better safeguard against similar activity.

Why it matters

The case shows a device maker deliberately infecting its own customers' hardware, which Google called an unacceptable breach of trust. The XCPE malware persisted on the /oem/ partition and reinstalled itself if removed, so affected devices would need clean firmware or disconnection from the internet to be secured. Shares of Alphabet (GOOGL) were up 0.07% in delayed trading at $279.19.

What to watch

Google said point-in-time disruptions are a critical tool but that lasting disruption will require continued targeting of the infrastructure. No further dated actions were disclosed.