Google has taken legal action to cut off a botnet that shipped inside the firmware of Android TV set-top boxes, and it says a Shenzhen device maker deliberately built the backdoor and sold access to criminals. The botnet, called x.cpe, was most often found on TV boxes but also turned up on telehealth devices, karaoke machines and digital signage.
Trend Micro’s TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1 and says the true total is likely higher, while the operation has been billed as covering about 1.3 million devices. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had roughly 26,000 to 42,000.
Google names Videostrong, a Shenzhen maker of Android TV boxes that also builds devices for other brands, and says it is highly confident the company acted on purpose rather than through an insider or an error. The backdoor ran with system-level access and could silently install apps, disable Google Play Protect checks, run commands, capture screens, log keystrokes and map home networks. Most add-on modules turned devices into residential proxies or sold their bandwidth, and others faked ad views.
Google seized domains and servers that controlled the botnet, along with control domains for more than a dozen malware families, working with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. It expects to cut off at least 10 million more infected devices but warns that the criminals can switch tools quickly. It also barred Videostrong and any future affiliates from building or selling certified Android devices.
Owners face a harder problem because the backdoor lives in the firmware and returns after restarts. Synthient published 182 model names linked to the campaign and advises discarding affected boxes, while Plume suggests a factory reset, though it is unclear whether that removes the backdoor. According to The Hacker News, Videostrong hid its code to get past certification testing by loading it after first boot, and as of November 2 its website still advertised Google Certified boxes.