Google says it disrupted XCPE and banned an Android device manufacturer
Google says it disrupted XCPE, a network of compromised Android devices, and barred manufacturer Videostrong from certified Android operations. Its investigation alleges that a factory-installed backdoor affected 1.3 million devices, enabling advertising fraud, unauthorized traffic routing and data theft. Television boxes were the main targets, alongside other connected equipment sold under several brands.
Artificial Intelligence··Morning
Google cuts command links and bans Videostrong
Google says it has disrupted XCPE, a botnet in which compromised Android devices receive commands without their owners’ knowledge. It also barred Videostrong, a device manufacturer based in Shenzhen, China, from manufacturing or selling certified Android equipment and supplying software for it. Google’s investigation alleges that the manufacturer deliberately embedded a backdoor in its products. The company estimates that 1.3 million devices were directly affected by the operation it has disclosed.[1], [2]
The backdoor activated when devices first started
According to Google, the malicious software activated when a device first booted and connected to the network. It was concealed among apparently ordinary system components across several models and brands sold over multiple years. Most affected products were Android TV boxes, but telehealth equipment, karaoke machines and digital signs were also involved. Google says the backdoor enabled advertising fraud, data theft and residential proxy services, which routed other parties’ internet traffic through purchasers’ connections.[1]
Affiliates used access to load further malware
Google alleges that Videostrong sold access to criminal affiliates that added their own malware modules. Its operation targeted command-and-control infrastructure used by those modules as well as XCPE itself. The company separately estimates that this action cuts access to about 10 million additional compromised devices reached through the affiliates’ other distribution channels. That figure covers a different group from the directly affected XCPE devices. Google also says it has revised its manufacturer review process.[1]
