Google’s Threat Intelligence Group says it has shut down a massive botnet called x.cpe. At its height, x.cpe ran on more than 1.3 million Android TV devices, and unusually, these were Google-certified boxes. Google says its screening process missed the malware due to “obfuscation techniques” employed by Shenzhen-based Videostrong Technology.
In a detailed blog post, the Threat Intelligence Group explains how the x.cpe botnet evolved quickly from a single-stage dropper into a modular three-stage malware platform that sold access to third parties. Manufacturers must have their devices certified if they want access to Google apps and branding, a process that is supposed to catch threats like this. However, Videostrong’s compromised boxes, mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online.
After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator’s behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious.
Google found most of the boxes were running residential proxies for routing large volumes of nefarious traffic or modules that engaged in ad fraud schemes. Selling access to this botnet was probably a big business. Videostrong also had full access to the devices, allowing operators to run terminal commands, capture the screen, and probe other devices on the local network. Google reportedly observed Videostrong doing this in real time.
Smashing the botnet
Google worked with several other organizations to disrupt the x.cpe network, including Japan’s National Police Agency, Synthient, and Trend Micro. Google says it has taken legal action to shut down the domains and servers Videostrong used to operate and install its malware. It also went after command and control servers operated by Videostrong that were connected to other malware campaigns. Google estimates Videostrong has been cut off from about 10 million compromised devices.
This action should make the affected devices safe to use, but probably not as safe as they should be. Play Protect is still disabled, and the inert malware modules are still installed. Since they are loaded as system apps, users cannot easily remove them.
Synthient has published a list of 182 device model names known to be included in the botnet. Anyone who has purchased a MECOOL or white label Android TV box of unknown origin should check it. Trend Micro counted a total of 1,472,554 infected devices, somewhat higher than Google’s estimate. The overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.
Google determined the operation was not the work of a rogue actor, so it has ended its relationship with Videostrong. The company, as well as any subsidiaries, will not be permitted to use Google’s Android apps and services.
Google also notes that it is updating its certification process to close the loophole that allowed Videostrong to operate its botnet on certified devices. Android is open source, though, and there are countless un-certified Android-based TV boxes out there. Videostrong could continue to sell malicious hardware under other brands without Google apps. But it would still have to rebuild its malware operation from scratch.
