Google takes down a botnet hidden in 1.3 million Android TV boxes
In short: Google’s Threat Intelligence Group cut off XCPE, a network living in the firmware of certified TV boxes that, according to its investigation, the manufacturer itself built to make money.
Google’s Threat Intelligence Group (GTIG) announced on November 2 that it took down XCPE, a botnet that lived inside more than 1.3 million Android TV boxes, including devices with Google certification. According to its investigation, Videostrong Technology, a Chinese manufacturer, developed and operated it on purpose to make money.
How it worked inside
The code came installed at the factory, in the firmware, with system-level permissions (the highest level in Android) and names such as x.cpe or com.oemservice. If someone deleted it, it reinstalled itself on reboot from the /oem/ partition. It also switched off Google Play Protect before downloading more modules and received orders over a permanent MQTT connection.
What the attackers could do
With that door open they could silently install apps, run commands with administrator privileges, map the home network, capture the screen, inject keystrokes and open a remote shell on the device.
How they made money
Videostrong sold access to other criminals, who loaded their own modules. Some used the owner’s internet connection as an exit point for other people’s traffic (so-called residential proxies); others committed ad fraud with invisible apps that sent fake impressions. Google found up to three proxy programs on a single device, and the same code also turned up on telehealth devices, karaoke machines and digital signage.
What Google did
It took legal action against the domains and servers Videostrong used to control the network and against those of more than a dozen malware families loaded through that door. It also banned Videostrong and its future subsidiaries from building or selling certified devices, and changed how it verifies the firmware of certified Android TV hardware. Google admitted that the obfuscated code was loaded after the first boot, which let it slip past testing.
The operation was carried out with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google also estimates that at least 10 million more devices, infected by affiliates’ modules, could lose remote control once those servers went down; that is its own estimate, and not all of them come from XCPE. The map it published shows devices on almost every continent, with Brazil and Southeast Asia among the most marked areas.
What to do
Google says that, with the network dismantled, affected devices should be safe to use. It still recommends buying connected devices only from reputable brands (and checking its list of certified partners), installing apps only from trusted stores, keeping Play Protect on, and being wary of apps that pay you to “share your internet” or for “unused bandwidth”, the main way these illegal networks grow.
If you have a TV box or an Android TV and you are unsure, this is a good time to check where it came from and which apps it has installed. At MBTECNIC we follow this kind of news closely because the security of the devices you use every day is part of looking after your technology.
