GOOGLE DISMANTLES BOTNET ON 1.3 MILLION ANDROID TV BOXES

Google's Threat Intelligence Group has dismantled a botnet called x.cpe, which Google said ran on more than 1.3 million Android TV set-top boxes at its peak. The devices were Google-certified hardware, mostly sold under the MECOOL brand and manufactured by Shenzhen-based Videostrong Technology. Google said Videostrong built the malware into the devices and used obfuscation techniques to pass its certification checks. Working with Japan's National Police Agency, Synthient and Trend Micro, Google said it took legal action against the domains and servers used to run the operation, and has blocked Videostrong from future Android certification.

Google said the malware ran through a stub application named x.cpe, or com.oemservice, which held system-level permissions that let it disable Google Play Protect and silently install further malware modules once a device was online. Most of the compromised boxes were used to run residential proxies that routed large volumes of internet traffic, or to carry out advertising fraud, Google said. Videostrong kept remote access to the devices, including the ability to run terminal commands, capture screens and probe other devices on the same network, which Google said it observed happening in real time. "A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users," Google said.

Google said Videostrong also ran command-and-control servers linked to separate malware campaigns. Acting against that wider infrastructure, Google estimated Videostrong has lost access to about 10 million compromised devices. Google said it has strengthened its Android certification checks to guard against similar hidden backdoors. The company said selling botnet access to other operators had likely formed a significant part of Videostrong's business.