Google takes down XCPE, a botnet its maker built into more than 1.3 million Android TV boxes

Google and industry partners have dismantled XCPE, also called X.CPE, a backdoor and botnet running on more than 1.3 million Android set-top boxes, the company said Monday. Google attributes the operation with high confidence to Videostrong Technology, a China-based original equipment and device manufacturer. According to Google, Videostrong built the backdoor into many device models and brands over several years and sold access to criminal affiliates. Those affiliates loaded malicious modules onto the devices and used them for ad fraud, data theft, residential proxy services and installing more malware. Google says the operation used dedicated infrastructure and frequently changing configurations to avoid detection. Google took legal action to seize the botnet's domains and servers. It also took down command-and-control domains used by more than a dozen malware families that ran as modules through XCPE. Google says this cut off access to at least 10 million other compromised devices, which were infected by other means and include retail set-top boxes, karaoke machines and telehealth hardware. Not all of them run Android. Google has ended its relationship with Videostrong, revoked its license to make Android TV devices with Google apps and services preinstalled, and banned the company and any future affiliates from producing certified devices. The case shows that a certified manufacturer can deliberately ship compromised devices to consumers without its own customers knowing.