Google has named the manufacturer behind a backdoor found in more than 1.3 million Android TV set-top boxes, and says the infection was deliberate rather than an accident.
What happened
On 2 November Google published its findings on the XCPE botnet, which it dismantled with partners in late October. The company says it assesses with high confidence that Shenzhen manufacturer Videostrong developed, deployed and operated the backdoor for money, selling access to criminal affiliates who then loaded their own modules onto the boxes.
The component, x.cpe, runs as a system app inside the firmware and is signed with the manufacturer's key. It reports to command-and-control servers, switches off Play Protect checks so apps can be installed silently, and can run commands, capture the screen, read account details and open a reverse shell. Most payloads turned the boxes into residential proxies or ad-fraud nodes.
Because the backdoor is part of the firmware, removing it does not stick: it returns after a restart. Google has banned Videostrong from building certified Android devices and from supplying software to other certified makers.
Who is affected
This is cheap consumer hardware, which is exactly why it ends up in small businesses.
- Retail, restaurant and hospitality sites using Android TV boxes for menu boards or digital signage.
- Offices and clinics where a consumer box was added for a screen, a kiosk or a meeting-room TV.
- Anyone running MECOOL-branded boxes. Security firm Synthient published 182 model names seen in the campaign, and TrendAI counted 1,472,554 infected devices across 206 models between June and October.
What to do now
Treat every cheap Android TV box on a business network as untrusted hardware and get it off the LAN. A factory reset may clear the added modules, but the firmware backdoor itself needs vendor action or replacement.
- Inventory signage, kiosk and meeting-room boxes by model, and compare them against Synthient's published model list and indicators.
- Replace affected units rather than cleaning them. For signage, buy from a brand with a firmware update path you control.
- Put any retained consumer device on an isolated VLAN with no route to servers, NAS or management interfaces.
- Block the command-and-control domains and addresses listed in Synthient's report at the firewall and at DNS.
- Keep corporate email and VPN access on managed devices only. Boxes on staff home networks are part of your attack surface.
What this means for South African businesses
Cheap Android boxes are sold here by every second electronics retailer and are the default choice for a menu board or a shop-window screen, usually installed by whoever mounts the TV and then forgotten. My judgement is that the real risk to an SME is not ad fraud: it is that a device with a vendor-signed backdoor and a live reverse shell sits on the same flat network as the file server and the POS system. Nobody will patch it, because there is nothing to patch.
Source
Google's Threat Intelligence team published the technical account and the takedown details. Full report: Shutting the Door on the XCPE Botnet.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.