That cheap Android TV box under your television may have been doing a lot more than streaming shows. Google said on November 2 that it led a takedown of a botnet of more than 1.3 million Android devices, most of them TV set-top boxes, and it says the company that made the boxes built the backdoor in on purpose. The backdoor, called x.cpe, came preinstalled in the firmware with system-level control, and owners cannot remove it. Google says it is highly confident that Videostrong, a device maker based in Shenzhen, China, intentionally developed and ran the operation to make money by selling access to criminals.
This is not the usual story of a hacker finding a hole in a product and slipping in. Google says the supplier was the operator. Videostrong makes Android TV boxes under its own name and for other brands, and Google found the backdoor in many models and brands over several years. Google says this was no rogue employee or mistake. The backdoor ran as a system app with the highest level of access Android gives, and it reported to command servers that told it what to do. Once it was in, it switched off Google Play Protect, Android's built-in security check, and then it could install apps silently, run commands, capture the screen, inject keystrokes, copy out account details and system logs, and open a remote shell straight into the box.
What the criminals did with that access was mostly about money. The main business was turning the boxes into residential proxies, which means renting out the owner's home internet connection so someone else's traffic looks like it comes from an ordinary household. Other modules faked views of online ads to collect ad revenue. Google took legal action to seize the domains and servers that controlled the botnet, and the control domains of more than a dozen malware families loaded through the backdoor. Because those criminals also spread their malware through other routes, Google expects the action to cut off their access to at least 10 million more infected devices, though those devices remain infected.
The scale of the problem is bigger than the 1.3 million figure suggests. TrendAI, Trend Micro's enterprise security unit, counted 1,472,554 infected devices across 206 models between June 3 and October 1, and said the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most infections, while the United States, Germany, the United Kingdom, Australia and Canada each had 26,000 to 42,000. Most of the infected devices were TV boxes, but Google also found the backdoor in telehealth equipment, karaoke machines and digital signage. The security firm Synthient, which worked with Google on the investigation, published a list of 182 device model names seen in the campaign. It traced the operation to MECOOL-branded boxes and found the backdoor preinstalled in a MECOOL KM9PRO Max bought off the shelf.
Here is the part that should worry anyone who owns one of these boxes: there is no fix. Because x.cpe lives in the firmware, signed with the maker's own key, uninstalling it does not stick. It reinstalls itself from a protected partition every time the box restarts. TrendAI says cleanup needs vendor action, platform protection or a new device. Synthient goes further and tells consumers to throw the boxes away. Google has cut ties with Videostrong entirely, banning the company and any future subsidiaries or affiliates from building or selling certified Android devices or supplying software to other certified device makers. Google says it has changed its review process, because Videostrong hid its code to slip past the compatibility and security tests Google requires of device makers, loading the malicious code only after a device's first boot.
The obvious question is how a company gets away with this for years while selling boxes that carry Google's own certification. Part of the answer is that the boxes were cheap and the brands unfamiliar, the kind of thing you buy because it costs a third of a name-brand streamer and promises the same apps. Google says it changed its checks of the firmware on certified Android TV devices, but as of November 2, Videostrong's own website was still listing products it calls a Google Certified Android TV Box and a Google Certified Android TV Stick. The company did not respond to a request for comment from The Register. The takedown cut the strings, but the boxes are still sitting under televisions with the backdoor inside them, and the people who bought them may never know. If your streaming box came from a brand you had never heard of, at a price that seemed too good to be true, that is the one to worry about.
---------------
Author: Ryan Gardner, Silicon Valley News Desk