Google dismantles botnet secretly running on 1.3 million Android TV boxes

Google worked with several other organizations to disrupt the x.cpe network, including Japan’s National Police Agency, Synthient, and Trend Micro. Google says it has taken legal action to shut down the domains and servers Videostrong used to operate and install its malware. It also went after command-and-control servers operated by Videostrong that were connected to other malware campaigns. Google estimates Videostrong has been cut off from about 10 million compromised devices.

This action should make the affected devices safe to use, but probably not as safe as they should be. Play Protect is still disabled, and the inert malware modules are still installed. Since they are loaded as system apps, users cannot easily remove them.

Synthient has published a list of 182 device model names known to be included in the botnet. Anyone who has purchased a MECOOL or white label Android TV box of unknown origin should check it. Trend Micro counted a total of 1,472,554 infected devices, somewhat higher than Google’s estimate. The overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.

Google determined the operation was not the work of a rogue actor, so it has ended its relationship with Videostrong. The company, as well as any subsidiaries, will not be permitted to use Google’s Android apps and services.

Google also notes that it is updating its certification process to close the loophole that allowed Videostrong to operate its botnet on certified devices. Android is open source, though, and there are countless uncertified Android-based TV boxes out there. Videostrong could continue to sell malicious hardware under other brands without Google apps. But it would still have to rebuild its malware operation from scratch.