Google and its partners have disrupted the x.cpe botnet, which was linked to Videostrong and infected millions of Android TV devices. The operation involved legal action against the domains and servers used to distribute the malware, but affected devices may still contain an inactive malware module and have Google Play Protect disabled.
Google disrupts the x.cpe botnet
Google worked with the Japanese National Police Agency, Synthient, and Trend Micro to disrupt the x.cpe network. Google said it had taken legal action to shut down the domains and servers Videostrong used to operate the botnet and install malware. The company also tracked command-and-control servers operated by Videostrong that were connected to other malware campaigns.
Google estimates that Videostrong has been blocked from approximately 10 million compromised devices. Trend Micro counted 1,472,554 infected devices, a figure that was slightly higher than Google’s estimate.
Infected devices may still be vulnerable
The disruption makes the affected devices safer to use, but they may not be as secure as they should be. Google Play Protect remains disabled, and an inactive malware module is still installed. Because these components are loaded as system apps, users cannot easily remove them.
Synthient has published a list of 182 device model names known to have been part of the botnets. Owners of MECOOL or white-label Android TV boxes purchased from unknown manufacturers should check the list.
The overwhelming majority of infected devices were located in Brazil, Malaysia, Iraq, Mexico, and Taiwan. Tens of thousands of devices were also online in the United States, Germany, the United Kingdom, Australia, and Canada.
Google ends its relationship with Videostrong
Google determined that the operation was not the result of fraudulent activity and terminated its relationship with Videostrong. Videostrong and its subsidiaries are no longer permitted to use Google’s Android apps and services.
Google also said it is updating its certification process to close the loophole that allowed Videostrong to operate its botnet on certified devices. However, Android is open source, and countless uncertified Android-based TV boxes remain available.
Videostrong may continue selling malicious hardware under other brands without Google’s apps, although it would need to rebuild its malware operations from scratch.
Source: arstechnica.com