Google dismantles botnet on 1.3 million Android TV boxes
Google's Threat Intelligence Group has taken down a massive botnet called x.cpe, which was running on over 1.3 million Google-certified Android TV devices. The malware was developed by Shenzhen-based Videostrong Technology and was disguised to evade detection.
How the botnet operated
Videostrong's compromised boxes, mostly sold under the MECOOL brand, used a backdoor to remotely install the malware after the devices were set up and online. A stub application called x.cpe or com.oemservice would phone home, without any malicious capabilities of its own, but with the system-level permissions necessary to install malware modules at the operator's behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious.
The impact of the botnet
The malware allowed third parties to take control of the infected devices, turning them into part of a botnet. This compromised the security and privacy of users, as their data could be harvested or their devices used for malicious purposes.
Google's response
Google's Threat Intelligence Group identified the botnet and took action against it, shutting down the command and control servers.
Videostrong Technology
Videostrong Technology is believed to be behind the malware development, which compromised Google-certified Android TV boxes. The company has not yet commented on the issue.
Android TV box manufacturers and users affected
- Android TV box manufacturers, particularly those using Videostrong Technology, are affected by the incident.
- Users of affected Android TV boxes are also affected, as their devices were compromised and their data could be harvested or used for malicious purposes.
Google's Play Protect
Play Protect, Google's malware protection system, was disabled by the malware, leaving users vulnerable to further attacks.
Google's action against the botnet
Google's Threat Intelligence Group identified the botnet and took action, shutting down the command and control servers.
</body> </html><small>Source: Ars Technica — read the original story there.</small>
