Google dismantles botnet infecting 1.3 million Android TV boxes

Google’s Threat Intelligence Group says it has disrupted x[.]cpe, a botnet that reached more than 1.3 million Google-certified Android TV devices. Trend Micro counted 1,472,554 infected devices. Most were in Brazil, Malaysia, Iraq, Mexico and Taiwan, though tens of thousands were also online in the UK, US, Germany, Australia and Canada. The devices were mainly sold under the MECOOL brand or as white-label products made by Shenzhen-based Videostrong Technology.

Google says the malware evaded certification checks through obfuscation and was installed remotely after devices were set up and connected to the internet. A stub app called x[.]cpe or com[.]oemservice contacted its operators and used system-level permissions to install malware modules; it also disabled Play Protect. Google found modules using devices as residential proxies or for ad fraud. Videostrong could also run terminal commands, capture screens and probe local networks, and Google says it observed the company doing so in real time.

Google worked with Japan’s National Police Agency, Synthient and Trend Micro to disrupt the network, taking legal action against domains and servers used to operate it. Google estimates Videostrong has been cut off from about 10 million compromised devices. It says the action should make affected boxes safe to use, but Play Protect remains disabled and inert malware modules are still installed as system apps, making them difficult for users to remove. Synthient has published a list of 182 affected model names. Google has ended its relationship with Videostrong and is changing its certification process to address the loophole.