Google Dismantles Botnet Running on 1.3 Million Android TVs

Google's Threat Intelligence Group says it has dismantled a botnet called x.cpe that secretly ran on more than 1.3 million Android TV devices carrying Google's own certification mark, according to a report from Ars Technica. The malware rode inside boxes made by Shenzhen-based Videostrong Technology, most sold under the MECOOL brand, and used a backdoor to install malicious code after the devices had already passed Google's certification review and reached customers.

The case is notable because the affected hardware carried Google's certification, a program meant to assure buyers a device meets security and compatibility standards before it ships.

How Did the Malware Get Past Google's Certification?

Device makers seeking access to Google apps and branding must pass a certification process designed to catch threats like x.cpe, Ars Technica reported. Videostrong's boxes evaded that screening using what Google described as "obfuscation techniques," then exploited a backdoor to install malware remotely once devices were already online in customers' homes. A stub application called x.cpe, or com.oemservice, phoned home after setup and disabled Play Protect, Google's built-in malware scanner, before pulling additional modules from Videostrong's servers.

What Did the Botnet Actually Do?

Most infected boxes ran residential proxy software, which routes outside traffic through victims' home connections, or modules carrying out ad fraud, according to Google's findings as reported by Ars Technica. Videostrong kept full remote access to compromised devices, letting operators run terminal commands, capture screens, and probe other devices on the same home network.

Google said it had "observed Videostrong doing this in real time," according to the outlet's account of the company's findings.

How Big Was the x.cpe Botnet?

• Google counted more than 1.3 million infected Android TV devices at the botnet's peak.
• Trend Micro's independent tally put the figure higher, at 1,472,554 infected devices.
• Google estimates Videostrong has now lost remote access to roughly 10 million compromised devices tied to its broader infrastructure.
• Security research group Synthient published a list of 182 device model names linked to the botnet.
• Infections were concentrated in Brazil, Malaysia, Iraq, Mexico and Taiwan, with tens of thousands of devices elsewhere, Ars Technica reported.

What Should Android TV Box Owners Do Now?

Google worked with Japan's National Police Agency, Synthient, and Trend Micro to take down the domains and command-and-control servers Videostrong used, per Ars Technica. That action should block new malicious commands, but it does not clean already-infected boxes. Play Protect remains disabled on affected hardware, and the malware modules are installed as system apps that owners cannot easily remove. Anyone who bought a MECOOL device, or an unbranded Android TV box of unknown origin, should check Synthient's published model list.

Glossary

• Botnet: A network of compromised devices controlled remotely, often without owners' knowledge.
• Residential proxy: Software that routes outside internet traffic through a victim's home connection to disguise its origin.
• Certified Android TV device: Hardware that has passed Google's review process for access to Google apps and branding.

What to Watch

• Whether Google changes its certification process to catch backdoors installed after initial review.
• Whether other manufacturers are found running similar remote-install schemes.
• Whether affected owners get a way to remove the inert malware modules, since Play Protect cannot currently be re-enabled on infected units.

AlterEgo — A keyboard for character voices. Five free persona rewrites a day.