Google says a TV box maker built a botnet into 1.3 million Android devices. What to do if you own one

Google says it has taken down XCPE, a botnet that lived inside the firmware of more than 1.3 million Android set-top boxes, and that the company that made many of those boxes put it there on purpose. In a November 2 post, Google Threat Intelligence Group said it has "high confidence" that Videostrong Technology Co., an Android device maker and white-label manufacturer, built, deployed and ran the backdoor for profit, then sold access to criminal affiliates.

Why it matters: this wasn't a dodgy app someone side-loaded. The malware shipped preinstalled with system privileges, and, according to The Hacker News, Videostrong's website still described some products as "Google Certified" on November 2. Google says disrupting the affiliates' control servers should also cut off access to at least 10 million more compromised devices from other sources.

What the backdoor did

Google describes a three-stage design:

Once online, a box sent hardware details to a control server and then held an always-on connection that accepted commands to silently install apps, run shell commands, capture the screen, inject keystrokes and scan the local network, Google says. The backdoor also switched off Google Play Protect's app verification so it could install software unchecked. Google says it saw operators copying account information and system logs and opening reverse shells.

Most of the modules sold the box's internet connection as a residential proxy or generated fake ad views, according to The Hacker News. Since August, Google adds, operators have pushed droppers disguised as Android system apps that use a privilege-escalation library to gain root.

How it slipped through certification: Google says the malicious code was obfuscated and loaded only after the first boot, getting past its pre-launch device tests.

How big, and where

• More than 1.3 million set-top boxes, in more than 200 countries, per Google partner TrendAI (Trend Micro).
• TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, The Hacker News reports, with the most in Malaysia, Brazil, Iraq, Mexico and Taiwan. The US, Germany, the UK, Australia and Canada each had tens of thousands.
• Researchers at Synthient focused on MECOOL-branded boxes and found the backdoor preinstalled on a MECOOL KM9PRO Max they bought; Plume found most devices talking to the botnet's control server were MECOOL units, according to The Hacker News.
• The backdoor also turned up on Android-based telehealth devices, karaoke machines and digital signs, CyberScoop reports.

What Google did

Google says it used legal action to take down the domains and servers that controlled the botnet, plus control domains for more than a dozen module families. It has banned Videostrong and any future subsidiaries or affiliates from making certified Android devices or supplying software to certified makers, changed its partner review process to catch code that loads after first boot, and tightened firmware integrity checks on certified Android TV devices. Partners included Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google's Charley Snyder called it a cross-industry effort in Trend Micro's announcement.

What to do if you own an Android TV box

1. Check the brand and maker. Videostrong builds boxes under its own name and for other brands. If you have a MECOOL box, treat it as suspect. Synthient published a list of 182 model names, but warns a model name alone doesn't confirm infection (via The Hacker News).
2. Look for the package names, if your box lets you list system apps: Google's indicators include x.cpe, com.oemservice, com.abc.nexus, com.ota.service and com.newtv.cboxtv.
3. Don't count on uninstalling it. Google says the backdoor reinstalls on reboot. TrendAI says cleanup needs vendor action, platform protection or replacing the device; Synthient advises consumers to throw affected boxes away. Plume suggests a factory reset to clear add-on modules, but hasn't said whether that removes the backdoor itself.
4. Unplug it from your main network until it's replaced. Organizations should hunt for these devices with the published indicators, block the listed domains and IPs, and keep smart devices on a separate network segment, The Hacker News reports.
5. Buy replacements from listed partners. Google points to its Android TV partner list, recommends keeping Play Protect on, and says to be wary of any app that pays you to "share" unused bandwidth — a common way proxy networks recruit devices.

What to watch: whether Google names the other manufacturers behind the "10 million more" devices, and whether retailers pull Videostrong-built boxes. Security teams should pull the full indicator tables from Google's post.