15:29Machine-translated from Azerbaijani by AIRead in Azerbaijani
Manufacturer Infected 1.3 Million TV Devices, Google Shut Down the Network
Google has dismantled a botnet called XCPE, a network built from infected devices. More than 1.3 million TV devices were connected to the network. Most were streaming boxes running Android TV and Google TV. What primarily sets this incident apart is that the malware was deliberately installed on the devices not by users, but by the manufacturer.
According to the investigation, China-based Videostrong Technology was behind the network. The manufacturer added a backdoor that provided covert access to the devices’ firmware. This method was used for years across various brands and models. Although the company had official certification, it concealed the code to evade inspections. As a result, the malicious code downloaded after the initial startup was not detected during certification checks. Once a device was running, the backdoor could download other malware without the owner’s knowledge. Videostrong Technology sold access to infected devices to criminal groups. Those groups used home internet connections to conceal their traffic, commit ad fraud, steal data, and take over accounts. The devices were also used in DDoS attacks, which overwhelm servers with excessive requests and cause them to crash. Even if the malware was removed, the backdoor could reinstall it when the device restarted. The problem was not found only in TV streaming boxes. The same method was also discovered in telemedicine devices, karaoke equipment, and devices used to manage digital advertising displays. Shutting down the command-and-control servers could cut off connections to at least 10 million additional devices. However, taking the servers offline does not mean the malicious code remaining on the devices will be removed automatically.
Google took legal action to shut down the domains and servers controlling the botnet. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI also joined the operation. The domains that were shut down controlled more than 12 malware families distributed through XCPE. Videostrong Technology and its subsidiaries and affiliated companies have been banned from manufacturing certified Android devices and developing software for these manufacturers. Following the incident, Google tightened its procedures for reviewing the firmware of certified Android TV devices. The approval process was also updated to close the loophole that allowed code to be downloaded after initial startup. Users are advised to keep Google Play Protect enabled and choose devices from trusted manufacturers. Those who own a device manufactured by Videostrong Technology are advised to disconnect it from the internet and replace it.
According to the investigation, China-based Videostrong Technology was behind the network. The manufacturer added a backdoor that provided covert access to the devices’ firmware. This method was used for years across various brands and models. Although the company had official certification, it concealed the code to evade inspections. As a result, the malicious code downloaded after the initial startup was not detected during certification checks. Once a device was running, the backdoor could download other malware without the owner’s knowledge. Videostrong Technology sold access to infected devices to criminal groups. Those groups used home internet connections to conceal their traffic, commit ad fraud, steal data, and take over accounts. The devices were also used in DDoS attacks, which overwhelm servers with excessive requests and cause them to crash. Even if the malware was removed, the backdoor could reinstall it when the device restarted. The problem was not found only in TV streaming boxes. The same method was also discovered in telemedicine devices, karaoke equipment, and devices used to manage digital advertising displays. Shutting down the command-and-control servers could cut off connections to at least 10 million additional devices. However, taking the servers offline does not mean the malicious code remaining on the devices will be removed automatically. Google took legal action to shut down the domains and servers controlling the botnet. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI also joined the operation. The domains that were shut down controlled more than 12 malware families distributed through XCPE. Videostrong Technology and its subsidiaries and affiliated companies have been banned from manufacturing certified Android devices and developing software for these manufacturers. Following the incident, Google tightened its procedures for reviewing the firmware of certified Android TV devices. The approval process was also updated to close the loophole that allowed code to be downloaded after initial startup. Users are advised to keep Google Play Protect enabled and choose devices from trusted manufacturers. Those who own a device manufactured by Videostrong Technology are advised to disconnect it from the internet and replace it.