Malware infecting Android devices isn’t new, but Google’s recent report is grim and concerning. The search giant has taken down a massive botnet that turned over 1.3 million Android TV set-top boxes into tools for cybercriminals. Unlike the usual attacks, where users end up downloading some shady apps from the internet, the malware here was planted inside the devices by the manufacturer itself.
According to the Google Threat Intelligence Group, the company behind it is China-based Videostrong Technology. Google has now cut ties with the manufacturer and banned it from building or supplying software for certified Android devices.
How did the malware work?
The botnet, called XCPE, relied on a backdoor built directly into the device’s firmware. So, what exactly was it doing? Well, once the device was switched on, the backdoor could download additional malware without the owner knowing anything about it.
Google and partners just shut the door on the XCPE botnet, severing criminal access to 10M+ devices. 🛡
— Google Cloud Security (@GoogleCloudSec)
Instead of a hacker breaking in, a device maker hid a backdoor in its own TV boxes to sell access to cybercriminals.
Full story: https://t.co/9gBcoGa0bG pic.twitter.com/sPqfJn7mor
Google says Videostrong was selling access to these infected devices to criminal groups. The latter used them for activities ranging from advertising fraud to stealing data and routing internet traffic through people’s home connections.
In a nutshell, even if someone managed to remove the malware, the backdoor could install it again when the device restarted. The problem wasn’t limited to TV boxes, either. Google also found it on telehealth devices, karaoke machines, and digital signage hardware.
What happens to these infected devices now?
Google worked with security firms and Japan’s National Police Agency to disrupt the servers used by the botnet. The company says taking down the infrastructure used by associated criminal groups could also cut off access to at least 10 million additional compromised devices. However, the malware already sitting inside the devices doesn’t necessarily go away with the servers being shut down.
Google has also made changes to its device certification checks. For users, the company recommends buying devices from reputable manufacturers and keeping Google Play Protect enabled. And if you own a device made by Videostrong Technology, it’s best to disconnect it from the internet and consider replacing it with one from a trusted brand.
RELATED COVERAGE: