Google Shuts Down Botnet of 1.3 Million Android TV Boxes

Google, together with its partners, shut down the infrastructure of the XCPE botnet, which had more than 1.3 million devices connected to it, most of them Android TV boxes. According to Google, the malware was deliberately embedded into the firmware by the manufacturer itself, Videostrong Technology.

The company sold other operators access to these devices. They were used for ad fraud, as residential proxies, and to install other malware.

The Fission and HiddenView modules were used for ad fraud. The former registered fake ad impressions even without displaying the ads themselves. The latter opened websites in hidden windows and simulated user actions, including clicks, page scrolling, and video views.

Proxy modules were also found on the devices: AppSalt from Honeygain (owned by Oxylabs), Popanet from NetNut, and Traffmonetizer. They made it possible to use the TV box owners’ internet connections to transmit traffic without their consent.

The backdoor was located in the system firmware partition and could automatically restore itself after being removed when the device rebooted. It also made it possible to disable Google Play Protect app scanning, remotely install apps, execute commands, take screenshots, and retrieve data from devices, including account information.

The TV boxes were released under different brands. To bypass Google’s security checks, Videostrong loaded the malicious code after the devices were first launched.

Google succeeded in taking down XCPE command-and-control servers and blocking domains used by more than a dozen malware families. According to the company’s estimates, this should deprive the attackers of access to at least 10 million other infected devices.

Google also ended its partnership with Videostrong. The company and affiliated entities were barred from manufacturing and selling certified Android devices, as well as supplying software to other certified manufacturers.