Google and its partners have disrupted XCPE, a botnet of roughly 1.3 million devices. Google alleges that Android device manufacturer Videostrong ran the operation, which infected set-top boxes and IoT devices with a backdoor to create infrastructure for criminal activity.
What We Know
Based on the summary published by Dark Reading:
- Scale: about 1.3 million devices
- Device types: set-top boxes and other IoT devices
- Mechanism: a backdoor on the devices that turned them into infrastructure for criminal activity
- Alleged operator: Videostrong, an Android device manufacturer, according to Google
We were unable to retrieve the full report, so details such as the specific criminal uses, the legal or technical actions taken, and the list of partners are not covered here. Check the original coverage and Google's own announcement for those.
Why It Matters
This is another case of a supply chain compromise at the device level. A backdoor present on hardware as it ships is hard for owners to detect or remove, and low-cost Android set-top boxes and IoT devices rarely receive reliable updates. Devices like these on a home or business network can be used to proxy malicious traffic through a victim's IP address.
Recommendations
- Inventory unmanaged Android-based streaming boxes and IoT devices on your networks.
- Place such devices on an isolated VLAN with restricted outbound access.
- Prefer devices from vendors with Google Play Protect certification and a track record of security updates.
- Monitor for unexplained outbound traffic from consumer media devices.
- Replace devices that no longer receive updates, or that originate from a vendor named in this disruption.