Google led a takedown of a botnet of more than 1.3 million Android devices, mostly TV set-top boxes. Google says it’s highly confident the box maker, Videostrong of Shenzhen, built the backdoor in on purpose and sold access to criminals.
What it did
- The backdoor, called x.cpe, runs as a system app in the firmware with system-level access. It switches off Google Play Protect so it can install apps silently.
- Criminals used the boxes for ad fraud and as residential proxies, sending other people’s traffic through owners’ home internet.
- Google used legal action to seize the control domains and servers, plus those of a dozen-plus malware families loaded through the backdoor. It expects that to cut off access to at least 10 million more infected devices.
- Videostrong and any future affiliates are banned from certified Android.
The bad part
The backdoor is still on the boxes, and owners can’t remove it. If you have a cheap no-name Android TV box, unplug it. If you can’t do that, put it on an isolated IoT VLAN with no access to the rest of your network.
God Bless, and Needs Garlic!
