Police and Tech Firms Disrupt Botnet of 1.3 Million Android TV Boxes Shipped With a Backdoor

A coalition of private-sector security firms, working with Japan's National Police Agency, has disrupted XCPE, a backdoor used to build a botnet of more than 1.3 million Android devices across more than 200 countries. Google, Lumen, Human Security, Plume, Synthient and TrendAI took part. Google Threat Intelligence Group said it assesses with high confidence that Videostrong Technology, a Shenzhen-based maker of Android TV boxes and projectors, built, deployed and operated the backdoor for financial gain.

According to Google, the backdoor was embedded in device firmware and access was sold to criminal affiliates, who could install extra malware modules. When customers connected the devices to their home networks, operators could use those internet connections to run proxy networks and hide malicious traffic, without the owners knowing. TrendAI said the preinstalled agent posed as a standard remote-management client, pulled updates from a GitHub page, and connected to a server that gave operators full remote control, including installing and removing apps and changing settings. Between June 3 and October 1, TrendAI recorded more than 3.8 million distinct home and mobile IP addresses linked to the operation.

The coalition also disrupted the domains used to manage the affiliate modules. Google assesses this will cut access to at least 10 million additional compromised devices. Google has since cut ties with Videostrong and banned it from making devices with preloaded Google apps. Videostrong did not immediately respond to The Register's inquiries.