Technology and Scienceupdated 1h ago2 min read
Archive photo · 4 July 2024Google Dismantles XCPE Botnet, Says Videostrong Technology Co. Built Backdoor
14 Other1 Western MainstreamPhoto: Premeditated, CC BY-SA 4.0 · Cropped for layout
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
XCPE infected more than 1.3 million Android TV boxes via preinstalled firmware. Google links Videostrong Technology to deliberately developing and deploying the backdoor for profit.
Save coverage image
Google targets XCPE botnet
Google’s Threat Intelligence Group dismantled the XCPE botnet, which at its height ran on more than 1.3 million Android TV devices. Google said it assessed with high confidence that Videostrong Technology Co. intentionally developed, deployed, and operated the backdoor and botnet for financial gain. Google described the malware as built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage affiliates.
Google said the campaign was not an isolated rogue insider or a development oversight, and it took legal action to disrupt the command and control domains that operated affiliate modules. Google said the takedown severed access to at least 10 million additional compromised devices beyond the XCPE botnet itself.
How the backdoor worked
Google said the XCPE backdoor and botnet were supported by a three-stage architecture, with a primary backdoor operating at the android.uid.system privilege level. Google said x.cpe ran as com.oemservice in some builds and was preloaded in the firmware partition, and it automatically reinstalls from the /oem/ partition upon reboot. Google said x.cpe offloaded module execution to an external loader, com.abc.nexus, which acted as the C2 communicator and configured and initialized monetization modules.
Google said the monetization modules transformed infected devices into residential proxy exit nodes and ad-fraud engines, and it said some modules executed additional backdoors that loaded even more monetization modules. Google said the command and control traffic used MQTT, and it identified mqtt.szbboys[.]com on ports 3885–3887.
Consequences for devices and users
Google said it banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices in the future, or supplying software to other certified vendors. Google said it implemented changes to its existing review process to better safeguard against similar activity in the future, after Videostrong employed obfuscation techniques to exploit a gap in Google’s tests and load malicious code after the device’s first boot. KrebsOnSecurity reported that the XCPE botnet loaded software that made the user’s Internet address available for resale by multiple “residential proxy” services.
KrebsOnSecurity quoted the GTIG post saying, “Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” linking the disruption to ad fraud and residential proxy activity. Google said point-in-time disruptions were a critical tool, but it warned that lasting disruption in the fluid ecosystem would require continued targeting of the infrastructure behind backdoor operators, ad-fraud rings, and residential proxy providers.