Google says a TV box maker hid a backdoor in 1.3 million Android TV boxes

The skim

• Google says a Chinese set-top box maker, Videostrong Technology, deliberately shipped Android TV boxes with a hidden backdoor that turned more than 1.3 million of them into a botnet.
• Google took legal action against the botnet's domains and servers and banned Videostrong from certified Android devices. Cutting off affiliated control servers also blocks access to at least 10 million more devices, it says.
• The takedown doesn't remove the malware from boxes already in homes. If you own a cheap, off-brand Android TV box, check it now.

What happened

In a report published Monday, Google's Threat Intelligence Group said it and industry partners dismantled a botnet it calls XCPE last week. "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.," Google wrote, adding: "We believe this campaign wasn't an isolated rogue insider or a development oversight."

The backdoor, a system app named x.cpe (also seen as com.oemservice), ran with system-level privileges and reinstalled itself from a protected partition every time the box rebooted. Google says it switched off Google Play Protect and loaded modules for ad fraud and for selling the owner's internet connection as a residential proxy. Operators could also take screenshots, inject keystrokes and pull account data from the device. Videostrong used obfuscation "to exploit a gap in our tests and load malicious code after the device's first boot," Google said.

Google said it worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. It has banned Videostrong and its future subsidiaries and affiliates from certified Android devices and from supplying software to certified vendors, and says it has strengthened its firmware integrity checks. "A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust," Google wrote.

How big is it, and who's affected

TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, The Hacker News reports. Most were in Malaysia, Brazil, Iraq, Mexico and Taiwan, but the US, Germany, the UK, Australia and Canada each had tens of thousands. Many were MECOOL-branded boxes, and researchers at Synthient found the backdoor preinstalled on a MECOOL KM9PRO Max, according to BleepingComputer. Synthient published a list of 182 model names, though a model name alone doesn't prove a box is infected.

Why it matters

This is the risk of bargain streaming boxes: the threat came from the factory, not from an app you chose to install. Your TV box can quietly rent out your home internet connection, which can put your IP address behind someone else's fraud, and the backdoor could reach accounts you signed into on it.

What to do

• Check what you own. If you have a no-name or MECOOL Android TV box, check whether its maker is on Google's certified partner list.
• Don't count on a reset. Google's action cut off the servers, but the backdoor is still on infected boxes and reinstalls itself if removed. BleepingComputer says owners would need clean firmware, or should disconnect the box from the internet. Plume recommends a full factory reset but doesn't say whether that removes x.cpe itself; TrendAI says cleanup needs "vendor action, platform protection or replacement of the device," and Synthient recommends throwing suspect boxes away.
• Change passwords for any accounts you signed into on a suspect box, from a different device.
• Buy from known brands and keep Play Protect on. Google also warns to be wary of any app that offers to pay you for "unused bandwidth."

Sources: Google Threat Intelligence Group, The Hacker News, BleepingComputer and 9to5Google.