Google disrupts XCPE botnet: TV box maker sold backdoor access to 1.3 million devices

Google has disrupted the XCPE botnet, which covered more than 1.3 million Android devices, mostly TV boxes. Google says the maker Videostrong built the backdoor and sold access, and has barred it from making certified devices.

Google and its partners disrupted the XCPE botnet in late October. By Google's count it included more than 1.3 million devices, mostly Android set-top boxes, and reports of the action appeared on 2 November. Google's threat intelligence group has high confidence that the manufacturer itself, Shenzhen-based Videostrong Technology, built the backdoor and sold access to criminal partners.

Through the backdoor, criminal groups loaded their own modules onto the devices. They used them for ad fraud and to run residential proxy networks, where attacker traffic appears to come from ordinary homes and offices. According to The Next Web, the backdoor reinstalls itself after deletion, and taking down the control infrastructure did not clean the boxes.

Google ended its relationship with Videostrong, revoked its licence to ship Google apps on Android TV devices and barred it from producing certified devices. The Next Web notes that on 2 November the maker's website still advertised Google Certified boxes. Both certified and open-source Android builds were affected.

For European companies the point is simple: the devices were not infected through user error. The backdoor shipped in the manufacturer's firmware, so ordinary caution does not help. A cheap smart box in a meeting room, reception or hotel room can be an entry point into your network and a source of traffic that your IP address ends up answering for.