Google and industry partners have disrupted the XCPE botnet, which enrolled more than 1.3 million TV set-top boxes after malware was embedded in their firmware before sale.
In its November 2 report, Google Threat Intelligence Group said it assesses with high confidence that Videostrong Technology Co., an Android device manufacturer and designer, intentionally developed, deployed and operated the backdoor for financial gain.
Google said Videostrong sold access to criminal affiliates, whose modules used infected devices for ad fraud, residential proxy services and additional malware. The backdoor was built into multiple device models and brands over several years and could reinstall itself after reboot. The pre-sale firmware infection recalls earlier Android-device botnet reports, including Abijita’s coverage of the Vo1d botnet and Google’s BadBox 2.0 case.
According to Google, Videostrong used obfuscation to bypass pre-release security checks and load malicious code after a device’s first boot. Google has changed its review process, severed ties with Videostrong and banned the company, its future subsidiaries and affiliates from making certified Android devices or supplying software to other certified vendors.
The coordinated operation involved Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google said it took legal action to disrupt the botnet’s control servers and command-and-control domains used by more than a dozen malware families. Because those affiliates distribute their modules through other channels too, Google estimates the domain takedown will sever access to at least 10 million additional compromised devices.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
