cyber.hendryadrian.com
Security News · malwarebytes.com

Google Says Videostrong Backdoor Put 1.3 Million Android TV Boxes in a Botnet

· Original article ↗

Summary

Google says Videostrong built the XCPE backdoor found in 1.3 million Android TV boxes and sold criminals access. A takedown disrupted the botnet, but the backdoor remains in infected devices’ firmware.

Key points

  • Google’s Threat Intelligence Group says it has high confidence that Videostrong built and ran the XCPE backdoor for financial gain.
  • The backdoor was embedded in firmware with system-level privileges and could reinstall itself after reboot if removed.
  • Google says affiliate modules used infected boxes for residential proxy traffic, ad fraud, remote access, and loading additional malware.
  • Google and partners took legal action to disrupt the botnet’s control infrastructure, but the takedown did not remove the backdoor from infected devices.
  • Google has not published a complete list of affected models; owners who suspect infection are advised to disconnect the box and contact the seller or manufacturer about clean firmware or replacement.

Article Details

Event Type
Google reported that Videostrong Technology built and operated the XCPE backdoor in certified Android TV boxes and sold criminal affiliates access to the resulting botnet; Google and partners took legal action to disrupt its control infrastructure.
Impact
Google says 1.3 million boxes were affected. The backdoor enabled residential proxy traffic, ad fraud, screenshot capture, keystroke injection, collection of account and device information, reverse shells, and loading additional malware. The takedown disrupted the botnet’s current connection to malicious servers but did not remove the backdoor from infected devices’ firmware.

MITRE ATT&CK

T1056.001 · KeyloggingGoogle observed operators injecting keystrokes on infected devices.T1090.003 · Multi-hop ProxyResidential proxy modules routed other people’s traffic through infected boxes and their owners’ home IP addresses.T1105 · Ingress Tool TransferCriminal affiliates reportedly loaded their own malware modules onto the boxes.T1113 · Screen CaptureGoogle observed operators capturing live screenshots from infected devices.T1542.001 · System FirmwareThe backdoor was embedded in device firmware and reportedly reinstalled itself from the /oem/ partition after reboot.T1562.001 · Disable or Modify ToolsThe backdoor could switch off Google Play Protect app verification.

Threat Actors

Videostrong Technology Co.Google’s Threat Intelligence Group says with high confidence that Videostrong Technology built and ran the XCPE backdoor for financial gain and sold criminal affiliates access to the botnet.

Malware

XCPE(GTIG) says it has high confidence that Android device maker Videostrong Technology built and ran the XCPE backdoor for financial gain. Videostrong sold access to criminal affiliates, who loaded their own malware GTIG found that the backdoor, called x.cpe (or com.oemservice in some builds), sits in the firmware with system-level privileges. If someone uninstalls it, it reinstalls itself from the /oem/ partition when the device

Vendors

GoogleGoogle says Videostrong backdoored 1.3 million certified Android TV boxes and sold criminals access to the botnet.Videostrong Technology Co.Google’s Threat Intelligence Group (GTIG) says it has high confidence that Android device maker Videostrong Technology built and ran the XCPE backdoor for financial gain. Videostrong sold access to criminal affiliates,

Products

Android TVGoogle says Videostrong backdoored 1.3 million certified Android TV boxes and sold criminals access to the botnet.Google Play Protectit reinstalls itself from the /oem/ partition when the device reboots. It could also switch off Google Play Protect app verification, allowing it to install more software without asking.

Related Articles