Overview
Google and industry partners have dismantled XCPE, a botnet of more than 1.3 million Android TV streaming boxes. Google attributes it with high confidence to Chinese device maker Videostrong Technology Co., which it says installed the backdoor during manufacturing and sold access to criminal affiliates.
Partners in the operation included Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.
How the Malware Works
The backdoor is built into device firmware and runs with Android system-level privileges. It contacts a command-and-control server to obtain credentials for an MQTT broker, which operators use to issue commands. Operators can:
- Install apps and disable Google Play Protect
- Run shell commands and open reverse shells
- Capture screenshots and keystrokes
- Collect account and device data
Affiliates used infected boxes for residential proxy services, ad fraud, and for installing additional backdoors (Moyu, Spirit, and Bird).
Google's Actions
- Took down C2 servers used by more than a dozen malware families, cutting access to at least 10 million additional compromised devices, including non-Android hardware such as set-top boxes, karaoke machines, and telehealth devices
- Ended its relationship with Videostrong and revoked its license to build Android TV devices with preloaded Google apps
- Banned Videostrong and future affiliates from producing certified Android devices or supplying software to certified vendors
- Changed its certification review after finding Videostrong used obfuscation to evade security testing
Mitigation
The takedown did not remove the malware from devices. It reinstalls itself from the /oem/ partition if deleted, so cleanup requires flashing clean firmware. As a stopgap, disconnect the device from the internet to stop further malicious activity. No reliable self-check for infection has been published.
Takeaways
- Low-cost, uncertified streaming boxes can ship compromised from the factory
- Keep unmanaged IoT and media devices on an isolated network segment
- Replace devices from affected vendors rather than trying to clean them