Google Bans Chinese Device Maker and Disrupts XCPE Botnet Built Into Set-Top Boxes

Google has banned Chinese Android device maker Videostrong Technology and worked with partners to dismantle a botnet of more than 1.3 million set-top boxes. In a blog post published on November 2, the Google Threat Intelligence Group said it assessed "with high confidence" that Videostrong was responsible for the XCPE botnet and backdoor. Google says the company sold access to criminal affiliates and loaded their malware onto infected devices. That malware carried out ad fraud, silently enrolled devices into residential proxy networks, and installed further malware.

The backdoor was reportedly built into the firmware of many device models and brands over several years. Besides set-top boxes, affected products included telehealth devices, karaoke machines and digital signage. Google says the backdoor ran with high system privileges and reinstalled itself from the /oem/ partition after a reboot if a user tried to remove it. At startup it contacted a command server, which let affiliates run scripts, disable Google Play Protect and install apps without the user knowing.

The industry action also disrupted command servers that affiliates used to install more than a dozen malware families. Google claims this cut control of over 10 million compromised devices from the botnet operators. Google does not believe this was a rogue insider or a development oversight, and has cut ties with Videostrong and banned it from making devices with preloaded Google apps.