Google dismantles botnet secretly running on 1.3 million Android TV boxes
Google has cut ties with the company behind the botnet campaign.
Google's Threat Intelligence Group has terminated a vast botnet, codenamed x.cpe, which had infected over 1.3 million Android TV devices. Notably, these devices were certified by Google. The botnet managed to bypass Google's screening process owing to sophisticated obfuscation techniques employed by Videostrong Technology, based in Shenzhen.
The Threat Intelligence Group detailed the evolution of the x.cpe botnet, which transformed from an initial dropper into a sophisticated three-stage malware platform offering access for sale to third parties. Google devices are typically certified through a process that aims to detect such threats. However, Videostrong managed to compromise devices, mostly marketed under the MECOOL brand, by exploiting a backdoor to install the malware after the devices were operational.
The infection proceeded via a stub application named x.cpe or com.oemservice, which communicated with its operators and gained system-level permissions to install additional modules. Crucially, this application also deactivated Play Protect, the security feature designed to flag potential malware, allowing the silently installed packages to remain undetected.
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
