Videostrong-Built XCPE Backdoor Turns 1.3 Million Certified Android TV Boxes into Criminal Proxy Botnet
Google's Threat Intelligence Group (GTIG) has disclosed with high confidence that Android device maker Videostrong Technology built and operated a firmware-level backdoor called XCPE (also known as x.cpe or com.oemservice) on 1.3 million Google-certified Android TV boxes, then sold criminal affiliates access to the resulting botnet. The backdoor was injected after the device's first boot, allowing it to bypass Google's compatibility and security certification tests. Affiliates used the compromised devices as a residential proxy network, routed ad-fraud traffic through them, captured live screenshots, injected keystrokes, harvested account and device data, and opened reverse shells. Google and partners have taken legal action to disrupt the domains and servers used to control the botnet and have banned Videostrong and its affiliates from producing certified Android devices, but the backdoor itself remains embedded in infected firmware and is not removed by the takedown.
Detalhes técnicos
The XCPE backdoor runs with system-level privileges and persists from the device's /oem/ partition, automatically reinstalling itself after reboot even if uninstalled. It can disable Google Play Protect app verification, enabling silent installation of additional malicious modules, including further backdoors loaded by criminal affiliates. Because the backdoor was loaded post-certification, infected devices passed Google's security checks before being compromised.
Remediação
Uninstalling the malicious app does not remove the backdoor, which lives in the firmware itself. Users who suspect their TV box is affected should disconnect it from the network and contact the seller or manufacturer for clean firmware or a replacement. Google has not published a full list of affected models. General guidance includes buying from reputable manufacturers, avoiding "free TV" boxes or apps that pay for bandwidth sharing, keeping Play Protect enabled, using trusted app stores, and isolating IoT/TV devices on a separate network or VLAN with restricted outbound access.
Linha do tempo
-
Videostrong-Built XCPE Backdoor Turns 1.3 Million Certified Android TV Boxes into Criminal Proxy Botnet
ler a análise desta fonte ocultar
Google's Threat Intelligence Group (GTIG) has disclosed with high confidence that Android device maker Videostrong Technology built and operated a firmware-level backdoor called XCPE (also known as x.cpe or com.oemservice) on 1.3 million Google-certified Android TV boxes, then sold criminal affiliates access to the resulting botnet. The backdoor was injected after the device's first boot, allowing it to bypass Google's compatibility and security certification tests. Affiliates used the compromised devices as a residential proxy network, routed ad-fraud traffic through them, captured live screenshots, injected keystrokes, harvested account and device data, and opened reverse shells. Google and partners have taken legal action to disrupt the domains and servers used to control the botnet and have banned Videostrong and its affiliates from producing certified Android devices, but the backdoor itself remains embedded in infected firmware and is not removed by the takedown.
Technical Details
The XCPE backdoor runs with system-level privileges and persists from the device's
/oem/partition, automatically reinstalling itself after reboot even if uninstalled. It can disable Google Play Protect app verification, enabling silent installation of additional malicious modules, including further backdoors loaded by criminal affiliates. Because the backdoor was loaded post-certification, infected devices passed Google's security checks before being compromised.Remediation
Uninstalling the malicious app does not remove the backdoor, which lives in the firmware itself. Users who suspect their TV box is affected should disconnect it from the network and contact the seller or manufacturer for clean firmware or a replacement. Google has not published a full list of affected models. General guidance includes buying from reputable manufacturers, avoiding "free TV" boxes or apps that pay for bandwidth sharing, keeping Play Protect enabled, using trusted app stores, and isolating IoT/TV devices on a separate network or VLAN with restricted outbound access.