Google dismantles massive botnet hidden in Android TV boxes
The overwhelming majority of the infected devices in the X.CPE botnet are Android TV set-top boxes, Google said, adding that they observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines and digital signage devices.
Google's Threat Intelligence Group has terminated a vast botnet, codenamed x.cpe, which had infected over 1.3 million Android TV devices. Notably, these devices were certified by Google. The botnet managed to bypass Google's screening process owing to sophisticated obfuscation techniques employed by Videostrong Technology, based in Shenzhen.
The Threat Intelligence Group detailed the evolution of the x.cpe botnet, which transformed from an initial dropper into a sophisticated three-stage malware platform offering access for sale to third parties. Google devices are typically certified through a process that aims to detect such threats. However, Videostrong managed to compromise devices, mostly marketed under the MECOOL brand, by exploiting a backdoor to install the malware after the devices were operational.
The infection proceeded via a stub application named x.cpe or com.oemservice, which communicated with its operators and gained system-level permissions to install additional modules. Crucially, this application also deactivated Play Protect, the security feature designed to flag potential malware, allowing the silently installed packages to remain undetected.
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
