Skip to content
securitytabs

LiveUpdated

Google Disrupts x.cpe Botnet Built Into 1.3 Million Android TV Boxes

Google says it has shut down a network of more than 1.3 million Android TV boxes and similar devices that came with hidden malware from their maker and were rented out to criminals. Owners of low-cost set-top boxes may want to check who made their device.

Google disrupts botnet built into Android TV boxes
Google disrupts botnet built into Android TV boxes

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Google led a takedown of a botnet (a network of infected devices controlled remotely) called x.cpe, which lost control of its servers in late October. The Hacker News reports it spanned more than 1.3 million Android devices, mostly TV set-top boxes. [1][2]

Google says it is highly confident that Shenzhen-based Videostrong Technology intentionally put a backdoor in the devices and sold access to criminals. Google also banned the maker, according to BleepingComputer. [1][3][2]

How the devices were used

Criminals used the boxes for ad fraud and to pass other people's internet traffic through owners' home connections, according to Google. Google's Threat Intelligence Group says the devices were Google-certified, but its screening missed the malware because of obfuscation techniques. [1][3]

Google says the overwhelming majority of infected devices were Android TV set-top boxes, and it also saw other Android-based devices including telehealth devices, karaoke machines and digital signage. [4]

What is not yet known

The available coverage does not list affected models, indicators of compromise or steps for owners to clean or replace devices. [1][2][5][6]

Timeline

  1. Google said other infected Android devices included telehealth devices, karaoke machines and digital signage. [4]

  2. Google said its Threat Intelligence Group's screening missed the malware due to obfuscation. [3]

  3. Google banned Videostrong, according to the reported takedown. [2]

  4. Google said it had disrupted the x.cpe botnet and attributed it to device maker Videostrong. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Google says the botnet ran on devices such as TV set-top boxes, and that criminals routed traffic through owners' internet connections. No cleanup steps have been published in the coverage. [1][4]

What to do

  1. Check whether any Android TV boxes or signage devices in your office came from Videostrong Technology. [1]
  2. Ask your IT provider or the device seller whether the devices are affected and watch for Google guidance. [3]

Mid-size company

A small IT or security team

What to know

Google says the affected devices included telehealth devices and digital signage, so unmanaged Android-based hardware may sit on business networks. [4]

What to do

  1. Inventory Android-based set-top boxes, signage and IoT devices and identify their manufacturer. [4]
  2. Review network traffic from those devices for unexpected outbound connections. [1]

Large enterprise

A security operations team

What to know

Google says the devices were Google-certified and the malware evaded its screening, so certification alone did not indicate safety. [3]

What to do

  1. Identify devices from Videostrong Technology across offices, healthcare and signage deployments. [1][4]
  2. Monitor for proxy-like traffic from embedded Android devices, since Google says owners' connections were used to relay others' traffic. [1]

Sources

  1. [1]The Hacker News · Nov 2, 15:50 UTC
    Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Accesscontext
  2. [2]BleepingComputer · Nov 2, 18:16 UTC
    Google disrupts million-device XCPE Android malware botnet, bans TV box makercontext
  3. [3]Ars Technica Security · Nov 3, 17:08 UTC
    Google dismantles botnet secretly running on 1.3 million Android TV boxescontext
  4. [4]The Record · Nov 3, 19:48 UTC
    Google dismantles massive botnet hidden in Android TV boxescontext
  5. [5]CyberScoop · Nov 2, 21:58 UTC
    Google shuts down global botnet running on certified Android devicescontext
  6. [6]SecurityWeek · Nov 3, 09:22 UTC
    Google Dismantles XCPE Botnet of 1.3 Million Android Devicescontext