Low cost Android TV containers got here with malware, and Google says the producer was behind it

What we all know to date: Google has severed ties with Android TV field producer Videostrong Expertise over allegations that it pre-loaded a backdoor on greater than 1.3 million set-top containers. Dubbed XCPE, the backdoor reportedly used “obfuscation strategies” to evade Google’s screening course of and enrolled contaminated gadgets in a large botnet that has since been shut down by the search large.

The backdoor was found within the firmware of a number of Videostrong gadgets, such because the Mecool KTI, in addition to a number of white-label Android TV containers. Seattle-based cybersecurity and fraud intelligence analysis group Synthient, which labored with Google to research the malware, claims it recognized at the least 182 completely different gadget fashions that had been contaminated with the backdoor and enrolled within the botnet.

The malware reportedly exploited a firmware vulnerability in Android containers to load malicious code after the gadgets booted for the primary time. First deployed in 2024 as a easy, single-stage dropper, the malware was rebuilt by Videostrong over the following couple of years with a modular, three-stage structure, making it extra resilient and enabling multi-tenant monetization.

Along with Android set-top containers, the malware was detected in a number of different Videostrong merchandise, together with telehealth gadgets, karaoke machines, and digital signage. The backdoor used numerous obfuscation strategies to bypass Google’s certification exams and disabled Play Shield, Google’s safety software that gives real-time malware safety on Android gadgets.

Based on Google’s Risk Intelligence Group, the contaminated gadgets had been included into a worldwide botnet that allowed criminals to commit advert fraud, steal information, seize screenshots, inject keystrokes, and open distant shells. The compromised gadgets had been additionally enrolled in proxy networks to route unauthorized site visitors to command-and-control servers operated by the criminals.

Explaining Videostrong’s function in spreading the XCPE backdoor, Google mentioned it had detected the malware in a number of gadget fashions from a number of manufacturers and that its distribution was supported by “devoted infrastructure.” The corporate added that the backdoor was designed to evolve all through its lifetime, altering its traits to evade detection because it enrolled extra gadgets in a quickly rising botnet.

The Shenzhen-based OEM reportedly monetized the backdoor by permitting cybercrime syndicates to load their very own malware modules onto contaminated gadgets. These secondary modules had been designed not solely to commit advert fraud and enroll compromised gadgets in residential proxy networks but additionally to put in extra malware.

To investigate the XCPE ecosystem and take down the command-and-control domains utilized by botnet operators and their associates, Google labored intently with a number of worldwide regulation enforcement companies and cybersecurity companies, together with Japan’s Nationwide Police Company, Lumen, HUMAN Safety, Plume, Synthient, and TrendAI.

It’s price noting that whereas Google estimates the overall variety of affected gadgets at round 1.3 million, TrendMicro says it counted a complete of 1,472,554 contaminated gadgets throughout the US, Canada, Germany, the UK, Australia, Brazil, Malaysia, Iraq, Mexico, and Taiwan.

Google says it has taken a number of steps to forestall related incidents from taking place once more, together with banning Videostrong and its associates from manufacturing licensed Android gadgets or supplying software program to different Android distributors and Google companions. The corporate can also be enhancing its licensed Android program to make sure firmware integrity.