Google Bans Videostrong, Breaks 1.3M-Device XCPE Botnet

Google says it dismantled a botnet of more than 1.3 million Android TV and Google TV boxes whose firmware had been carrying a backdoor it calls XCPE, and that the manufacturer, Videostrong, put the backdoor there on purpose. 9to5Google reported the takedown, following work by Google's Threat Intelligence Group to trace the infrastructure and win a court order to block the command-and-control domains.

"We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates," Google said in its disclosure. The x.cpe backdoor runs as a system app inside the firmware with system-level access, according to The Hacker News, capable of installing apps without the owner knowing, running commands, capturing the screen and mapping the network the box sits on. The compromised devices were sold under the Mecool brand and reached more than 200 countries.

How Videostrong got past the certification lab is now the fix. "Videostrong hid its code to bypass a gap in those tests and loaded the malicious code after a device's first boot," the Hacker News reporting states, citing Google's analysis. Google has banned Videostrong and any future subsidiaries from building or selling certified Android devices and from supplying software to other certified device makers. Firmware integrity checks for certified Android TV devices have been tightened and the manufacturer review process rewritten to catch the same obfuscation trick.

Google's post stops short of saying whether the 1.3 million already-compromised boxes will see a remediated firmware push, or simply go dark once the C2 infrastructure is cut off.