Videostrong Technology Co. Barred After 1,3 million Android Devices Compromised
Google has banned Shenzhen-based manufacturer Videostrong Technology Co. from building, selling, and supplying software for certified Android devices after uncovering a covert backdoor embedded in 1,3 million consumer units, telset.id reported. The hardware was covertly transformed into an active botnet.
The unauthorized firmware modifications directed infected hardware into performing unprompted ad fraud, data exfiltration, and unauthorized network traffic routing. According to Google, the malicious infrastructure was deliberately developed and deployed for direct financial gain.
🚨 GOOGLE DISMANTLES XCPE BACKDOOR: 1.3M+ ANDROID TV BOXES PRE-INFECTED AT THE FACTORYGoogle and partners took down the XCPE botnet last week. Google says, with high confidence, that Shenzhen device maker Videostrong built the "x.cpe" backdoor into its firmware on purpose and… pic.twitter.com/MA61Vd8vGe
Videostrong monetized compromised network by selling backdoor access
Videostrong monetized the compromised network by selling backdoor access to external criminal affiliates. These third parties loaded secondary modules onto the hardware to automate ad fraud, enroll unwitting devices into residential proxy networks, and distribute supplemental malware payloads.
To disrupt the operation, Google dismantled the command-and-control domains utilized by these criminal affiliates. Because the various actors distributed their modules outside the primary XCPE framework, Google assessed that disabling those specific command servers successfully severed access to at least 10 million additional compromised units.
A TV box maker allegedly put a backdoor in its own firmware, and Google just shut it down.Google's Threat Intelligence Group says it worked with partners last week to dismantle XCPE, a botnet of more than 1.3 million Android set-top boxes. Google says the backdoor wasn't… pic.twitter.com/16FSdwzBwv
Malware reached far beyond a single product category
The malicious software reached far beyond a single product category, infiltrating various hardware models and brands over multiple years. While the bulk of the impacted units consist of Android TV set-top boxes, the botnet also ensnared IoT machinery including telehealth units, karaoke systems, and digital signage displays.
To evade detection during initial startup, Videostrong employed complex obfuscation techniques. The malware avoided triggering alarms during the initial boot sequence, instead deploying its malicious payloads silently during subsequent operating phases.
Google and partners dismantled the XCPE botnet, a supply-chain backdoor baked into Android TV firmware by OEM Videostrong Technology Co., enrolling 1.3 million set-top boxes and touching 10+ million additional devices via affiliate C2 infrastructure.Key findings:- The… pic.twitter.com/elDV3eTTlk
Infected devices executed unauthorized network traffic and ad fraud
What specific malicious activities did the infected devices perform?
The compromised hardware executed automated ad fraud, exfiltrated user data, and routed unauthorized network traffic without the knowledge or consent of the device owners.
How many total devices were impacted by the security breach?
Google confirmed that 1,3 million devices contained the direct manufacturer backdoor, while the takedown of associated command-and-control domains cut off access to an additional 10 million compromised units.
‼️ BREAKING: Google says Android TV box maker Videostrong infected its own users and sold the access to criminals.They built a backdoor into the firmware of 1.3M+ set-top boxes. If a user deleted it, it came back on the next reboot.Buyers turned the boxes into residential… pic.twitter.com/1dnhe6XP9o
What types of hardware were infected by Videostrong?
The malware infected Android TV set-top boxes, telehealth devices, karaoke machines, and digital signage displays across multiple brands over a period of years.
What penalties did Google impose on the manufacturer?
Google severed all business ties with Videostrong Technology Co. and prohibited the Shenzhen-based firm from building, selling, or supplying software for any certified Android devices.
Google just disrupted the XCPE Android TV box botnet and banned maker Videostrong. Here's what you need to know.The XCPE botnet hid in more than 1.3 million Android TV set-top boxes across 200 countries. Google says it has high confidence that Shenzhen device maker Videostrong… https://t.co/zsh8FOUery pic.twitter.com/RF0sBHUd40
Related reading