Skip to content
securitytabs

LiveUpdated

Google Dismantles XCPE Botnet Built Into Android TV Boxes

Google says a backdoor hidden in Android TV set-top boxes signed up more than 1.3 million devices into a criminal botnet, and that the boxes' maker ran it for profit. Google and partners have taken it down; owners of such boxes have no published steps yet.

Google dismantles botnet built into Android TV boxes
Google dismantles botnet built into Android TV boxes

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Google says it and industry partners dismantled the XCPE backdoor last week. The backdoor enrolled more than 1.3 million set-top boxes into a botnet, a network of infected devices controlled remotely. [1][2]

Google Threat Intelligence Group says it assesses with high confidence that Videostrong Technology Co., an Android device maker, developed, deployed and operated the backdoor and botnet for financial gain. Help Net Security reports the backdoor sat in the firmware of the boxes. [1][3]

How it made money

Google says Videostrong sold access to criminal affiliates and loaded those affiliates' malware modules onto infected devices. Google says the secondary modules were conducting ad fraud, among other activity. [1][3]

Google shut down the servers behind XCPE and banned the company, according to Help Net Security and BleepingComputer. [3][2]

What is not yet known

The available coverage does not say how owners can check or clean affected boxes, or whether the manufacturer has responded. [1][3][2]

Timeline

  1. Google said the botnet had enrolled more than 1.3 million Android TV boxes. [2]

  2. Google shut down the servers behind XCPE and banned the company. [3]

  3. Google Threat Intelligence published its assessment that Videostrong Technology operated the XCPE botnet. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Businesses that use low-cost Android TV boxes, for example in waiting rooms or offices, may own affected devices. Google has not published cleanup steps in the coverage available. [1][3]

What to do

  1. Check whether any Android TV set-top boxes on your network were bought from Videostrong Technology or an unfamiliar brand. [1]
  2. Ask your IT provider whether such boxes are connected to your office network. [3]

Mid-size company

A small IT or security team

What to know

The backdoor sat in device firmware, and Google says the maker sold access to criminal affiliates who loaded their own malware. [1][3]

What to do

  1. Inventory Android TV and streaming boxes connected to corporate networks and identify their manufacturers. [1]
  2. Watch for Google's guidance on affected devices. [1][2]

Large enterprise

A security operations team

What to know

Google attributes the botnet to a device manufacturer, which makes the firmware supply chain the point of compromise. [1][2]

What to do

  1. Identify unmanaged Android TV boxes on corporate or guest networks and segment them from internal systems. [1][3]
  2. Review Google's published analysis for indicators of XCPE before hunting in network logs. [1]

Sources

  1. [1]Google Threat Intelligence · Nov 2, 14:00 UTC
    Shutting the Door on the XCPE Botnetcontext
  2. [2]BleepingComputer · Nov 2, 18:16 UTC
    Google disrupts million-device XCPE Android malware botnet, bans TV box makercontext
  3. [3]Help Net Security · Nov 2, 15:50 UTC
    Google disrupts XCPE botnet, bans the company behind itcontext