Google Takes Down Android Botnet of 1.3 Million TV Boxes, Blames Maker for Selling Access to Criminals

Google has led a takedown of a botnet of more than 1.3 million Android devices, mostly TV set-top boxes, which lost control of its servers in late October. Google says it is highly confident that Shenzhen-based maker Videostrong intentionally placed a backdoor, called x.cpe, in the boxes and sold access to criminals. It does not believe a rogue insider or a mistake was to blame. The criminals used the devices for ad fraud and to route other people's internet traffic through owners' home connections.

According to Google's analysis, the backdoor runs as a system app inside the firmware with system-level access. It contacts the botnet's control servers and waits for orders, and it switches off the app checks in Google Play Protect so it can install software silently. Operators could also run commands, capture the screen and map the network the box sits on. Google says it saw some of these powers used, including live screenshots, sent keystrokes, and copying of account details, app lists and system logs. The backdoor is still on the boxes, and owners cannot remove it themselves.

Google used legal action to take down the botnet's domains and servers, plus the control domains of more than a dozen malware families loaded through the backdoor. It expects this to cut criminals off from at least 10 million more infected devices, though it warns such groups quickly switch to new tools. Google has also banned Videostrong from building or selling certified Android devices.