Google warns Android TV boxes carry backdoor malware affecting 1.3 million devices
Google says a hidden backdoor installed by China-based manufacturer Videostrong infected more than 1.3 million Android TV boxes and other connected devices worldwide, and that criminals used them to form a botnet.
Google has disclosed that more than 1.3 million Android TV streaming boxes and other connected devices around the world were shipped with a hidden backdoor, according to its Google Threat Intelligence Group. The company says the malicious software was installed deliberately by the device manufacturer, Videostrong Technology, a China-based company, rather than picked up by accident after purchase.
The backdoor, called XCPE, was embedded in the devices' firmware, which means it reinstalls itself after a reboot or even a factory reset. Google says the operators of the malware sold access to the infected devices to criminal affiliates, who turned them into a botnet. Affiliates used the hardware to run residential proxy networks and to generate fake advertising activity that earned revenue for the people behind the scheme. Some of the modules also captured screenshots and keystrokes and stole account data from users.
Most of the affected hardware consists of Android TV streaming boxes, but the malware also reached other connected products, including karaoke machines and digital signage. Some of the infected devices passed Google's certification checks, and the malware was able to disable Google Play Protect's app verification, weakening one of the main defenses Android users rely on.
Google said it worked with Japan's National Police Agency and several cybersecurity firms to disrupt the operation. The company seized domains and servers used to control the devices and banned Videostrong and its affiliates from building certified Android devices in the future. Google estimates that at least 10 million other compromised devices are affected by related malware, though it did not provide details on how those figures were reached.
Researchers at Synthient examined a sample from a MECOOL KM9PRO Max device and listed model identifiers they had observed in connection with the malware. Those researchers stressed that a match with a listed model does not by itself confirm that a particular device is infected. Google has not published a full list of retail products that carry the malicious firmware.
The disruption of the servers does not remove the malicious firmware from devices already in people's homes, which means owners need to take their own precautions. Google advises users to check the model of their streaming box, disconnect any suspect device, and contact the manufacturer for clean firmware. Users are also advised to change their account passwords, enable two-factor authentication, and place streaming boxes on a separate guest network to limit what they can reach on the home network.
Source: foxnews.com
31
