Google says a manufacturer embedded a persistent backdoor in Android TV box firmware, enrolling more than 1.3 million devices in a botnet used for advertising fraud and bandwidth resale.
Security researchers at Google’s Threat Intelligence Group discovered that Videostrong Technology deliberately embedded a backdoor in its Android device firmware. The exploit was used to enroll over 1.3 million devices into a botnet, which analysts determined with high confidence was operated for profit.
This particular malware, called XCPE, operated as a privileged system process and was able to re-establish itself from an immutable firmware partition after rebooting. This made ordinary app removal ineffective. It may even interfere with Google Play Protect, perform silent installation of applications, run commands, take screenshots, and scan the network.
The operators earned money by selling access to infected devices for residential proxy services and advertising fraud. Most affected devices were Android TV boxes, but telehealth equipment, karaoke machines and digital signage were also involved. Google estimates that disrupting the affiliates’ control infrastructure could cut off access to at least 10 million additional compromised devices. This is a wider estimate, not a count of XCPE-infected boxes.
According to Google, Videostrong concealed the malicious code during device compatibility and security checks, loading it after the first start-up. Google has since updated its review and firmware-integrity checks, banned Videostrong and its affiliates from making certified Android devices, and taken legal action to seize related servers and domains. The operation involved partners including Japan’s National Police Agency, Lumen and HUMAN Security.
The incident raises concerns about firmware security in Android TV boxes. Google’s report does not identify the affected models or state how many infected devices were Google-certified. Another study reveals that there were instances where both certified and AOSP-based devices were affected, and hence one cannot assume certification in all the affected boxes.
Google recommends that users should stay away from applications that pay users to share their excess internet bandwidth, use trusted application stores, activate Play Protect, and buy devices from reputed manufacturers. However, ordinary app removal will not eliminate a firmware-level backdoor. Synthient has published a list of device identifiers and indicators associated with the campaign, but a model match alone does not confirm infection.
The available research does not establish how many affected devices are in India. The botnet disruption has also not necessarily cleaned devices already sold. Owners of potentially affected boxes may therefore remain exposed until the firmware or hardware is replaced.
For more information, click here.
