Google says it has shut down x.cpe, a botnet that at its peak operated on more than 1.3 million Android TV devices. The affected boxes were Google-certified, and many were sold under the MECOOL brand by Shenzhen-based Videostrong Technology, according to Google’s Threat Intelligence Group.
Google said its certification screening did not catch the malware because of obfuscation techniques. Rather than appearing as malicious software during certification, the compromised devices used a backdoor to install malware remotely after they had been set up and connected to the internet.
Once online, the boxes contacted an operator through a small application called x.cpe or com.oemservice. The app did not contain malicious functions itself, but had system-level permissions that allowed it to install additional modules. It also disabled Google Play Protect, which might otherwise have detected those packages.
The malware reportedly developed from a basic dropper into a three-stage platform that offered access to third parties. Google found that many infected devices were used as residential proxies to route large volumes of traffic or to carry out advertising fraud. Videostrong also had broad access to the boxes, including the ability to run terminal commands, capture screens and inspect other devices on local networks. Google said it observed the company exercising that access in real time.
Google says it has cut ties with the company behind the campaign.
Sources: Ars Technica.