Cyber ·
Google and partners dismantle XCPE botnet that infected 1.3 million Android TV boxes
According to Google Threat Intelligence Group, a botnet of Android TV boxes used as residential proxies and in ad fraud has been shut down. The Chinese manufacturer Videostrong was named as responsible for including the malware.
Google said it worked with industry partners to dismantle the XCPE botnet, made up of more than 1.3 million Android TV boxes carrying malicious software. This software secretly rented users' internet connections to third parties and carried out ad fraud. Experts involved in the operation say the action will likely cut the botnet's access to more than 10 million other compromised systems, including Android-based health devices and karaoke machines.
The Google Threat Intelligence Group report says Google cut ties with Videostrong Technology, a Chinese TV box maker that, according to GTIG and other experts, included the malware. The report says the company sold access to criminal affiliates and loaded their modules onto infected devices. Google also took legal action to take down the domains and servers used to control the botnet. According to the text, the same malware was found in other Android-based IoT products, and Google says it has already fixed the vulnerability that allowed software to be installed right after first use.
To consult and verify, read the original Google Threat Intelligence Group report and the source article, indicated in the bookmark as the Krebs on Security feed. The text received was truncated, so check the full details before citing numbers or names.