Google says it and a group of security and law-enforcement partners disrupted the Google XCPE botnet after the malware enrolled more than 1.3 million set-top boxes. The company has banned Videostrong Technology Co., an Android original equipment and design manufacturer, from the certified Android device business after accusing it of deliberately operating the backdoor for profit.
In a November 2 disclosure, Google’s Threat Intelligence Group said it assessed with high confidence that Videostrong developed, deployed and ran the XCPE backdoor and botnet. That is Google’s allegation, not an independent legal finding.
Google said it worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI on the disruption. Plume said the botnet was present in more than 1.3 million set-top boxes across more than 200 countries.
How did the Google XCPE botnet get onto set-top boxes?
According to Google, the malicious component was planted in device firmware before sale. Firmware is the low-level software that starts and operates hardware, so this was not an infection that depended on an owner clicking a bad link or installing a dodgy app.
Google said the main component, called x.cpe in some builds and com.oemservice in others, ran with Android system privileges. It said the software could restore itself from the device’s OEM partition after a reboot if someone removed it.
The company said Videostrong used obfuscation to get malicious code onto devices after their first startup, exploiting a gap in Google’s manufacturer testing. Google found the software across multiple device models and brands over several years, it said. Most affected devices were Android TV set-top boxes, though Google also identified Android-based telehealth devices, karaoke machines and digital-signage hardware.
Once active, the malware contacted command-and-control infrastructure and maintained an MQTT connection to receive instructions, Google said. The company said those instructions could include silent app installs, shell commands, screen captures and network reconnaissance.
What was XCPE allegedly used for?
Google said Videostrong sold access to criminal affiliates, which loaded their own modules onto compromised devices. Those modules allegedly carried out ad fraud, added devices to residential proxy networks, installed further malware, extracted data and routed malicious network traffic through users’ connections.
A residential proxy turns a subscriber’s connection into an exit point for someone else’s traffic. In practice, that means outside activity can appear to originate from a household’s internet address, without the subscriber agreeing to it. Plume said researchers also found persistent remote-access capabilities and collection of device, network and account information.
Google took legal action against servers and domains it said controlled XCPE and delivered malware modules, as well as command-and-control domains for more than a dozen malware families delivered through the backdoor. Google separately estimates that disrupting those affiliate domains could cut operators off from at least 10 million additional compromised devices. That figure concerns affiliates’ wider distribution channels, not the 1.3 million XCPE-enrolled set-top boxes.
Google has cut ties with Videostrong and barred the company, along with future subsidiaries and affiliates, from building or selling certified Android devices or supplying software to certified vendors. It also said it changed its review process and strengthened firmware-integrity checks for certified Android TV devices. The disclosure does not provide a complete list of affected products or say what remediation is available to every owner.
This story draws on original reporting from The Verge.
