WORLDTECHGoogle dismantles botnet hidden in certified Android TV set-top boxes
Google said on Monday that it had dismantled a botnet, a network of hijacked machines controlled by a single operator, which an approved Android device maker had deliberately installed across more than 1.3 million TV set-top boxes. According to CyberScoop, the devices arrived with malware already on board and still got past Google's security tests.
How the hidden backdoor spread
Google says Videostrong Technology Co., an Android original equipment and device manufacturer based in China, built a backdoor into multiple devices it sold. A backdoor is a concealed entry point into a system that avoids its login process. These backdoors formed the XCPE botnet, which cybercriminals exploited for ad fraud, data theft and channelling malicious traffic through residential proxy networks, according to a Google Threat Intelligence Group report.
Videostrong sold TV set-top boxes and other devices already carrying malware. The harmful code only loaded after a device's first boot, which allowed the devices to pass Google's security tests over several years.
Google's countermeasures and revised review
Google took legal action against the domains and servers that Videostrong relied on to steer the network. It also removed command-and-control domains through which more than a dozen malware families ran as modules via the XCPE backdoor, a step the company said cut off access to at least 10 million further compromised devices from various manufacturers.
Videostrong and any future subsidiaries were barred from building or selling certified Android devices. Google said it had also changed its review process to spot and halt similar activity. Charley Snyder, head of disruption operations at GTIG, said the company would not disclose details of those changes so that threat actors could not get around them. Snyder declined to say when or how Google first learned that the approved vendor was running a botnet.
Where the infected devices turned up
Most devices in the XCPE botnet were Android TV set-top boxes, but researchers also found infected Android-based telehealth devices, karaoke machines and digital signs. The report states that users were unaware of the infection and had not consented to it, and that the infected devices served as a distribution route for a wide range of criminal actors. Between June and October, nearly 44,000 infected devices were located in the United States.
Open questions
- When and how did Google first become aware of the botnet?
- What changes did Google make to its device review process?