Google has disrupted a botnet of more than 1.3 million Android devices, primarily TV set-top boxes, after concluding with high confidence that Shenzhen-based manufacturer Videostrong intentionally built a backdoor called x.cpe into the firmware and sold access to criminals. The backdoor allowed silent app installation, remote commands, screen capture, and network mapping. Criminals mainly used the devices for advertising fraud and as residential proxies that sold owners’ home internet bandwidth. The malware also appeared on telehealth devices, karaoke machines, and digital signage. Google, working with Japan’s National Police Agency and security firms including Lumen, HUMAN Security, Plume, Synthient, and TrendAI, seized the control servers and domains of more than a dozen related malware families, potentially cutting off access to at least 10 million additional devices. Google has banned Videostrong from producing certified Android devices.
Google has disrupted a botnet of more than 1.3 million Android devices, primarily TV set-top boxes, after concluding with high confidence that Shenzhen-based manufacturer Videostrong intentionally built a backdoor called x.cpe into the firmware and sold access to criminals. The backdoor allowed silent app installation, remote commands, screen capture, and network mapping. Criminals mainly used the devices for advertising fraud and as residential proxies that sold owners’ home internet bandwidth. The malware also appeared on telehealth devices, karaoke machines, and digital signage. Google, working with Japan’s National Police Agency and security firms including Lumen, HUMAN Security, Plume, Synthient, and TrendAI, seized the control servers and domains of more than a dozen related malware families, potentially cutting off access to at least 10 million additional devices. Google has banned Videostrong from producing certified Android devices.