Google says it shut down the x.cpe botnet, which ran on more than 1.3 million certified Android TV devices, and ended its relationship with Videostrong Technology.
Google’s Threat Intelligence Group says it has shut down a botnet called x.cpe that ran on more than 1.3 million Android TV devices at its height. The devices were Google-certified, and Google says its screening process missed the malware because of obfuscation techniques used by Shenzhen-based Videostrong Technology.
After devices came online, a stub application called x.cpe or com.oemservice would phone home. The package had no malicious capabilities of its own but held system-level permissions to install malware modules at the operator’s request. It also disabled Play Protect, which would otherwise have flagged the silently installed packages.
Google found most of the boxes were running residential proxies for routing large volumes of nefarious traffic or modules engaged in ad fraud schemes. Videostrong also had full access to the devices, allowing operators to run terminal commands, capture the screen, and probe other devices on the local network. Google reportedly observed Videostrong doing this in real time.
Google worked with Japan’s National Police Agency, Synthient, and Trend Micro to disrupt the x.cpe network. It took legal action to shut down the domains and servers Videostrong used to operate and install its malware, and went after command-and-control servers connected to other malware campaigns. Google estimates Videostrong has been cut off from about 10 million compromised devices.
Google determined the operation was not the work of a rogue actor, so it has ended its relationship with Videostrong. The company, as well as any subsidiaries, will not be permitted to use Google’s Android apps and services.
Google says it is updating its certification process to close the loophole that allowed Videostrong to operate its botnet on certified devices. Play Protect remains disabled on affected devices, and the inert malware modules are still installed. Since they are loaded as system apps, users cannot easily remove them.
Trend Micro counted a total of 1,472,554 infected devices, somewhat higher than Google’s estimate. The overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada. Synthient has published a list of 182 device model names known to be included in the botnet.
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
No comments yet. Start the discussion.
TechTrending
Environmental groups delivered a petition of nearly 55,000 signatures to Google's London headquarters opposing data centre plans at the former Arena Essex Raceway, but say Google refused to accept it.
The Rural Municipality of Sherwood council unanimously approved bylaws to rezone 895 acres for Bell Canada's 1.2-gigawatt AI data centre expansion near Regina, following a public hearing.
