US — Ars Technica
Google dismantles botnet secretly running on 1.3 million Android TV boxes
Security2 min read
Google says it shut down a huge botnet called x.cpe. This is a network of hacked devices that criminals control remotely. It ran on more than 1.3 million Android TV boxes, including devices that Google had certified as safe.
What happened
Google's Threat Intelligence Group, a security team that studies online threats, took down a botnet called x.cpe. At its peak, it infected more than 1.3 million Android TV boxes. These are small devices that plug into a TV to stream shows and apps. The malware was hidden inside boxes made by a company in Shenzhen, China, called Videostrong Technology. Most of the boxes were sold under the MECOOL brand.
Key numbers and facts
- More than 1.3 million Android TV devices were infected at the botnet's height.
- The boxes were Google-certified, which means they had passed Google's approval screening.
- Most infected boxes were sold under the MECOOL brand.
- Most boxes were used to route large amounts of bad traffic through residential proxies, or to run ad fraud (faking ad views or clicks to steal money).
How the trick worked
Manufacturers must pass Google certification to use Google apps and branding. Videostrong got around this check. Its boxes passed screening, then a backdoor (a secret way in) let the company install malware after the devices were set up and online. A small app called x.cpe, or com.oemservice, contacted a control server once a device was online. This app had no harmful code of its own. But it had deep system permissions, so it could install other malware modules on command. It also turned off Play Protect, Google's built-in tool that blocks harmful apps. That let the hidden software install without being caught.
Why it matters
This shows that a device can pass a safety check and still be dangerous later. Videostrong also had full control of the boxes. It could run commands, take screenshots, and scan other devices on the same home network. Google reportedly saw this happening in real time. People who bought these boxes may have had their home networks used for crime without knowing it.
What to watch
- Whether Google changes its certification process to catch backdoors like this one.
- Whether owners of MECOOL and other Videostrong boxes get removal tools or updates.
- Whether the people who bought access to the botnet are identified and stopped.
Glossary
- Google's Threat Intelligence Group
- A Google security team that tracks and studies online threats and attacks.
- botnet
- A network of infected devices that one person controls remotely, often for crime.
- Videostrong Technology
- A Shenzhen-based company whose boxes were used to hide the x.cpe malware.
- MECOOL
- A brand of Android TV boxes; most of the infected devices were sold under this name.
- Play Protect
- Google's built-in Android security tool that scans apps and flags harmful ones.