Google says it has disrupted the x.cpe botnet operated by Videostrong, working with the Japanese National Police Agency, Synthient and Trend Micro. The operation targeted malware-infected Android TV boxes, blocked access to the infrastructure used to control them and cut Videostrong off from Google’s Android apps and services. However, affected devices may still contain inactive malware and have Play Protect disabled.
Google disrupts the botnet
Google said it took legal action to shut down the domains and servers Videostrong used to operate the x.cpe botnet and install malware. The company also tracked command-and-control servers run by Videostrong that were connected to other malware campaigns. Google estimates that Videostrong has been blocked from approximately 10 million compromised devices.
The action makes the affected devices safe to use, but they may not be as secure as they should be. Play Protect remains disabled, and an inactive malware module is still installed. Because these components are loaded as system apps, users cannot easily remove them.
Synthient has published a list of 182 device model names known to have been part of the botnets. Owners of MECOOL or white-label Android TV boxes purchased from unknown manufacturers should check the list.
Trend Micro counted 1,472,554 infected devices, a total slightly higher than Google’s estimate. The overwhelming majority were in Brazil, Malaysia, Iraq, Mexico and Taiwan. Tens of thousands of infected devices were also online in the United States, Germany, the United Kingdom, Australia and Canada.
Videostrong loses access to Google services
Google determined that the operation did not result from fraudulent activity and terminated its relationship with Videostrong. “We and our subsidiaries are not permitted to use Google’s Android apps and services,” the company said.
Google also said it is updating its certification process to close the loophole that allowed Videostrong to run its botnet on certified devices. Android remains open source, however, and many uncertified Android-based TV boxes are available. Videostrong could continue selling malicious hardware under other brands without Google apps, although it would have to rebuild its malware operation from scratch.
Source: arstechnica.com
