Google dismantles botnet secretly running on more than a million Android TV boxes

Google's Threat Intelligence Group says it has dismantled a botnet that ran on more than 1.3 million Android TV boxes — devices that carried Google's certification, its apps and its branding. Most were sold under the MECOOL brand by Shenzhen-based Videostrong Technology. Trend Micro, one of the firms that assisted in the takedown, counted 1,472,554 infected devices.

The boxes were compromised before they reached a living room, but not by anything certification is designed to catch. A stub application — x.cpe, or com.oemservice — sat on the devices with system-level permissions and no malicious capability of its own. Once a box came online, the stub phoned home, switched off Play Protect, which would otherwise have flagged what followed, and stood ready to install modules on the operator's instructions. Google says its screening missed the arrangement because of obfuscation techniques employed by Videostrong; the malware itself never had to cross the factory gate.

What crossed later was a business. The stub evolved from a single-stage dropper into a modular three-stage platform that sold access to third parties, and Google found most of the boxes running residential proxies for routing large volumes of traffic or modules engaged in ad fraud. Videostrong retained full access to the devices — terminal commands, screen capture, probing of other machines on the local network — and Google says it observed the manufacturer exercising that access in real time. The company concluded the operation was not the work of a rogue actor.

The infected boxes were overwhelmingly in Brazil, Malaysia, Iraq, Mexico and Taiwan, with tens of thousands online in the US, Germany, the UK, Australia and Canada. Working with Japan's National Police Agency, Synthient and Trend Micro, Google took legal action to shut down the domains and servers Videostrong used, including command-and-control infrastructure connected to other malware campaigns, and estimates the manufacturer is now cut off from about 10 million devices. Synthient has published a list of 182 device model names known to be in the botnet. Google has ended its relationship with Videostrong, whose subsidiaries will not be permitted to use Google's Android apps and services, and is updating the certification process the botnet slipped through.

The takedown shows what the certification regime can do: one company cut a manufacturer off from roughly ten million devices in a stroke. It also shows where it stops. The now-inert malware modules remain installed as system apps that users cannot easily remove, and Play Protect is still disabled on the affected boxes. Beyond the certified ecosystem, Android is open source, and countless uncertified TV boxes exist that no takedown can ever reach.

The servers are gone. The software Videostrong left on more than a million living-room devices is still there.