Google has disrupted a criminal operation that used backdoors installed at the factory on more than 1.3 million devices, according to the company. The malware was embedded in the system partition by the manufacturer rather than introduced through an accidentally exposed security flaw or a user-installed app.
The operation involved Videostrong, which assembled devices and supplied software for hundreds of models sold internationally. The boxes were configured to connect to external command-and-control servers as soon as they were connected to the internet.
The malicious component, identified as XCPE, disabled integrity checks and Google Play Protect. Infected devices could then join a botnet without obvious effects on video playback. Their computing resources and residential internet connections were sold to third parties and used for proxy traffic, automated ad views and unauthorised data collection.
Google says it shut down the central domains used to send commands to the network, cutting direct access to more than 10 million compromised devices. It also withdrew official licences and barred Videostrong and associated companies from producing further devices certified for its system.
The shutdown does not remove the malware from boxes already in use. Because the code is stored in the flash memory’s root partition, a factory reset will not eliminate it and the service returns after a restart. Although external measures have blocked communications with the malicious domains, the devices remain technically vulnerable.
Sources: Pplware.