Summary
Google says it and industry partners disrupted the XCPE backdoor botnet, which enrolled more than 1.3 million set-top boxes. The company also barred the device maker it identifies as responsible from certified Android device work.
Google’s Threat Intelligence Group says it and industry partners disrupted the XCPE backdoor botnet, which had enrolled more than 1.3 million set-top boxes. Most of the infected devices were Android TV boxes, though Google also found infections on other Android-based devices, including telehealth equipment, karaoke machines and digital signage.
Google assesses with high confidence that Videostrong Technology Co., an Android device manufacturer and design company, intentionally developed, deployed and operated the backdoor for financial gain. The company says it has cut ties with Videostrong, barred it and its affiliates from making certified Android devices or supplying software to certified vendors, and changed parts of its device review process.
A backdoor embedded in device firmware
Google describes XCPE as a system of malware components rather than a single ordinary app. The main backdoor, called x.cpe in some versions and com.oemservice in others, was preloaded in device firmware and ran with Android system-level privileges. If removed from the installed-app area, it could reinstall itself from a protected firmware partition when the device rebooted.
The backdoor contacted command-and-control servers to receive configuration and instructions. Google says the malware used HTTP to fetch initial settings, then maintained a connection using MQTT, a messaging protocol suited to devices that need persistent communication over networks. Commands could direct devices to install apps silently, run shell commands, capture screens and perform network reconnaissance.
A separate loader handled many of the additional components. These modules could turn devices into residential proxy nodes, routing other parties’ internet traffic through a household connection; run advertising fraud; or install further backdoors. Google says its analysis of command-and-control data found operators capturing live screenshots, injecting keystrokes and extracting account and device information, app inventories and system logs.
Google says Videostrong sold access to criminal affiliates and loaded their modules onto affected devices. Its report describes the malware as built into multiple device models and brands over several years. The company says obfuscation allowed malicious code to be added after a device’s first boot, exploiting a gap in its existing compatibility and security tests.
Disruption targets both the botnet and its affiliates
Google says it pursued legal action targeting the domains and servers used to control the botnet and install malware modules. It also took action against command-and-control domains used by more than a dozen malware families distributed through XCPE. Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI on analysis and disruption.
The company reports that XCPE had enrolled more than 1.3 million set-top boxes. Separately, Google estimates that disrupting affiliate command-and-control domains could sever access to at least 10 million additional compromised devices. That larger figure concerns affiliates whose malware also reached devices through channels beyond XCPE; it is not a count of additional XCPE-infected boxes.
Google says it has implemented changes to its review process and is improving checks on firmware integrity for certified Android TV devices. It expects the disruption to affect the criminal operations, while noting that the groups involved can shift to new loaders or other monetisation modules. The actions target the infrastructure and supply chain behind the activity; Google describes continued disruption as necessary because those operations are interconnected and can adapt.