Google Bans Videostrong After 1.3M Android TV Boxes Turned Into Botnet
Google has severed ties with Chinese manufacturer Videostrong Technology after discovering the XCPE backdoor embedded in 1.3 million Android TV boxes across 200+ countries. The malware enabled ad fraud and proxy networks. Google banned Videostrong from its ecosystem and disrupted command servers, potentially protecting 10 million additional devices from secondary malware modules.
Key points
- Google has permanently banned Shenzhen-based Videostrong Technology and its subsidiaries from manufacturing or selling certified Android devices and software due to the intentional embedding of the XCPE backdoor.
- The XCPE backdoor was pre-installed in firmware of over 1.3 million Android TV and Google TV boxes sold globally across more than 200 countries, allowing remote control by operators.
- Videostrong monetized the threat by selling access to criminal affiliates who used the infected devices for ad fraud, data exfiltration, and residential proxy networks.
- Google and partners disrupted command-and-control domains, a move that analysts assess will sever access for at least 10 million additional compromised devices using diversified distribution channels.
- The Mecool brand, a known Videostrong subsidiary, is among the affected devices, with reports suggesting the brand may be shutting down as a result of the scandal.
Global Botnet Disruption
Google has officially severed all business relationships with Videostrong Technology, a hardware manufacturer based in Shenzhen, China, following the discovery of a massive security breach involving its Android TV devices. The company confirmed that Videostrong intentionally embedded a backdoor known as XCPE into the firmware of its products, turning more than 1.3 million Android TV and Google TV boxes into a botnet. This action marks a significant enforcement of Google’s security standards, as the manufacturer has been banned from producing or selling any certified Android devices or supplying software to other certified vendors moving forward.
The XCPE Backdoor Mechanism
According to the Google Threat Intelligence Group (GTIG), the XCPE backdoor was not the result of a rogue insider or development oversight but was deliberately developed, deployed, and operated for financial gain. The malware was pre-installed in the firmware of various device models and brands over multiple years. It included a management agent that purported to be a standard remote-management client. This agent pulled updates from a GitHub page and connected to a Message Queuing Telemetry Transport (MQTT) server, granting operators full remote control over the devices. This access allowed criminals to install and remove applications, change settings, and route malicious traffic through the users' home networks without their knowledge.
Financial Motives and Affiliate Network
Videostrong’s primary method of monetization involved selling access to the backdoor to criminal affiliates. These affiliates then loaded additional malware modules onto the compromised devices. The secondary modules were responsible for conducting ad fraud, silently enrolling the infected devices into residential proxy networks, and loading further malware onto the XCPE-compromised hardware. Google stated that the campaign was supported by dedicated infrastructure and constantly evolving configurations designed specifically to evade detection. The scale of the operation was vast, with devices distributed across more than 200 countries, making it one of the largest known botnets involving consumer smart TV hardware.
Disruption and Secondary Impact
In response to the threat, Google, in collaboration with a coalition of private-sector security firms including Lumen, Human Security, Plume, Synthient, and TrendAI, along with Japan’s National Police Agency, has disrupted the command-and-control (C2) domains operating these affiliate modules. Google assesses with high confidence that this disruption will sever access for at least 10 million additional compromised devices. This larger figure accounts for affiliates who have diversified distribution channels for their malware modules beyond the XCPE backdoor, indicating that the initial 1.3 million devices were part of a much broader ecosystem of compromised hardware.
Impact on Mecool and Future Security
The fallout has specifically impacted Mecool, a well-known brand of Android TV and Google TV boxes that has been rumored to be shutting down. Mecool devices were among those identified by Synthient as potentially affected by the backdoor. Google acknowledged that the presence of such malicious software in certified devices represented a failure in its ecosystem oversight. As a result, the company is implementing stricter security improvements for the Android TV ecosystem to prevent similar incidents. The ban on Videostrong and its subsidiaries serves as a deterrent to other manufacturers, signaling that intentional security compromises will result in permanent exclusion from the Android certified program.
Key takeaways
- Google has permanently banned Videostrong Technology from the Android certified ecosystem due to the intentional embedding of the XCPE backdoor.
- The backdoor infected over 1.3 million Android TV boxes across 200+ countries, allowing remote control for ad fraud and proxy networks.
- Videostrong sold access to criminal affiliates who used the devices for financial gain, with Google disrupting C2 domains to protect an estimated 10 million additional devices.
- The Mecool brand, a Videostrong subsidiary, is among the affected devices, with reports suggesting the brand may cease operations.
- Google acknowledges this as a systemic failure and is implementing stricter security measures for the Android TV ecosystem.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
