Google and Partners Disrupt Botnet Linked to 1.3 Million Android TV Boxes

Google says it has taken legal action with industry partners to disrupt the XCPE botnet, which enrolled more than 1.3 million Android TV set-top boxes. The devices were supplied with malicious software that made users’ internet connections available to residential proxy services and supported advertising fraud, according to a report from the Google Threat Intelligence Group (GTIG).

GTIG said it severed ties with Videostrong Technology, a Chinese TV box manufacturer it and other experts identified as responsible for installing the malware. Google also took action against domains and servers used to control the botnet and load additional malicious software onto infected devices.

Residential proxies let customers route web traffic through other people’s internet addresses, which can conceal their identity or apparent location. GTIG said Videostrong sold access to the compromised devices to criminal affiliates, who could use them to distribute further malware. The report describes the practice as a serious breach of user trust because devices were used without owners’ knowledge or consent.

TV boxes accounted for most of the botnet, but GTIG also found the XCPE malware in other Android-based internet-connected products, including telehealth devices, karaoke machines and digital signage systems. Google said device makers are required to pass compatibility and security tests, but Videostrong had found a way to install its software during a device’s first startup. Google says it has since addressed that weakness.

The takedown is expected to cut XCPE’s access to at least 10 million additional compromised devices, according to GTIG. The group cautioned that affiliates had distribution channels beyond XCPE, while Synthient founder Ben Brundage described the reported figure of 1.3 million devices as a conservative estimate.

Google credited Synthient and other industry partners for their work on the disruption. Synthient separately reported finding Videostrong’s malware and proxy components on a pre-infected MECOOL TV box. Its report also linked the malware to proxy services including AppSalt, also known as Honeygain, and Grass. The GTIG report named several other proxy providers whose software development kits were downloaded by infected devices, including EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.

Sources: Krebs on Security.