Key facts
- Google said the x.cpe botnet ran on more than 1.3 million Google-certified Android TV devices, mostly MECOOL boxes made by Videostrong.
- Google said Videostrong used a backdoor to install malware after devices were set up, and disabled Play Protect to avoid detection.
- Google said it took legal action against Videostrong's domains and servers and estimated the company was cut off from about 10 million compromised devices.
- Trend Micro counted 1,472,554 infected devices, higher than Google's estimate, with most in Brazil, Malaysia, Iraq, Mexico and Taiwan.
- Google said it ended its relationship with Videostrong and barred the company and its subsidiaries from using its Android apps and services.
Google's Threat Intelligence Group said it shut down a botnet called x.cpe that ran on more than 1.3 million Google-certified Android TV devices, according to a blog post the group published. The boxes were mostly sold under the MECOOL brand by Shenzhen-based Videostrong Technology, and Google said its certification screening missed the malware because of obfuscation techniques the company used.
Google said the botnet grew from a single-stage dropper into a modular three-stage platform that sold access to third parties. A stub application called x.cpe or com.oemservice phoned home after devices came online, used system-level permissions to install malware modules and disabled Play Protect, which would otherwise have flagged the packages. Google said most boxes ran residential proxies routing large volumes of traffic or modules for ad fraud, and that Videostrong had full access to the devices, allowing operators to run terminal commands, capture the screen and probe other devices on the local network. Google said it observed Videostrong doing this in real time.
Google said it worked with Japan's National Police Agency, Synthient and Trend Micro to disrupt the network, and took legal action to shut down the domains and servers Videostrong used, including command and control servers connected to other malware campaigns. Google estimated Videostrong was cut off from about 10 million compromised devices. Trend Micro counted 1,472,554 infected devices, higher than Google's figure, with most in Brazil, Malaysia, Iraq, Mexico and Taiwan and tens of thousands also online in the US, Germany, the UK, Australia and Canada.
Google said the action should make affected devices safe to use but that Play Protect remains disabled and the inert malware modules are still installed as system apps that users cannot easily remove. Synthient published a list of 182 device model names known to be in the botnet. Google said it ended its relationship with Videostrong and will not permit the company or its subsidiaries to use its Android apps and services, and that it is updating its certification process to close the loophole.