Google disrupts XCPE botnet pre-installed by Videostrong on 1.3M+ TV set-top boxes
Google and partners disrupted XCPE, a botnet built from a backdoor that China-based Android OEM Videostrong Technology Co. deliberately pre-installed on more than 1.3 million TV set-top boxes. According to a Google Threat Intelligence Group (GTIG) report, cybercriminals used the infected devices for ad fraud, data exfiltration and routing malicious traffic through residential proxy networks. Google took legal action against the domains and servers Videostrong used for control, and also took down command-and-control domains of more than a dozen malware families that ran as modules through the XCPE backdoor. Google says this disrupted access to at least 10 million additional compromised devices from other manufacturers. It banned Videostrong and any future subsidiaries from building or selling certified Android devices, and said it changed its review process without disclosing details. The botnet spanned more than 170 countries, with the largest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan, and nearly 44,000 infected devices in the United States between June and October (per TrendAI). The takedown is already completed and involves no CVE; the severity is rated medium for defenders, although the scale of the compromise (1.3 million devices, more than 170 countries) is large.
Detalhes técnicos
- Videostrong shipped devices with malware for years and evaded Google's security tests by loading the malicious code after the device's first boot.
- The operators constantly evolved configurations to evade Google's pre- and post-launch detections, per GTIG's Charley Snyder.
- Most infected devices were Android TV set-top boxes; infected Android-based telehealth devices, karaoke machines and digital signs were also observed.
- Google assesses the campaign was not an isolated rogue insider or a development oversight.
- Partners in the disruption: Japan's National Police Agency, Lumen Technologies, Human Security, Plume and Synthient. TrendAI researchers provided the geographic distribution.
- Google warns the markets for backdoors, ad fraud and residential proxies are resilient and operate as an interconnected supply chain.
Remediação
- The article gives no user-facing guidance.
Linha do tempo
-
Google disrupts XCPE botnet pre-installed by Videostrong on 1.3M+ TV set-top boxes
ler a análise desta fonte ocultar
Google and partners disrupted XCPE, a botnet built from a backdoor that China-based Android OEM Videostrong Technology Co. deliberately pre-installed on more than 1.3 million TV set-top boxes. According to a Google Threat Intelligence Group (GTIG) report, cybercriminals used the infected devices for ad fraud, data exfiltration and routing malicious traffic through residential proxy networks. Google took legal action against the domains and servers Videostrong used for control, and also took down command-and-control domains of more than a dozen malware families that ran as modules through the XCPE backdoor. Google says this disrupted access to at least 10 million additional compromised devices from other manufacturers. It banned Videostrong and any future subsidiaries from building or selling certified Android devices, and said it changed its review process without disclosing details. The botnet spanned more than 170 countries, with the largest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan, and nearly 44,000 infected devices in the United States between June and October (per TrendAI). The takedown is already completed and involves no CVE; the severity is rated medium for defenders, although the scale of the compromise (1.3 million devices, more than 170 countries) is large.
Technical Details
- Videostrong shipped devices with malware for years and evaded Google's security tests by loading the malicious code after the device's first boot.
- The operators constantly evolved configurations to evade Google's pre- and post-launch detections, per GTIG's Charley Snyder.
- Most infected devices were Android TV set-top boxes; infected Android-based telehealth devices, karaoke machines and digital signs were also observed.
- Google assesses the campaign was not an isolated rogue insider or a development oversight.
- Partners in the disruption: Japan's National Police Agency, Lumen Technologies, Human Security, Plume and Synthient. TrendAI researchers provided the geographic distribution.
- Google warns the markets for backdoors, ad fraud and residential proxies are resilient and operate as an interconnected supply chain.
Remediation
- The article gives no user-facing guidance.