Most malware needs you to make a mistake. You click a bad attachment, or install something you should not have. The botnet known as XCPE needed nothing from its victims except that they plug in the device they had just bought.
Google said on November 2 that it had worked with industry partners to dismantle the network, which had enrolled more than 1.3 million Android TV set-top boxes around the world. Investigative reporter Brian Krebs laid out the details on his security blog, and the case matters to anyone who has ever bought an inexpensive streaming box from an online marketplace.
How the scheme worked
According to Google’s Threat Intelligence Group, the backdoor was built into the firmware of devices across many brands over several years. The company says it has high confidence that a Chinese device maker, Videostrong Technology Co., deliberately developed and ran it for profit. The code ran with system-level privileges and could restore itself from a protected part of the device after a user removed it. It could also switch off Google Play Protect, the built-in malware scanner.
Once a box was online, its operators could push apps and run commands on it remotely. Google says access was then sold to criminal customers, who loaded their own modules. Those modules carried out ad fraud and enrolled the boxes in what are known as residential proxy networks.
A residential proxy lets a paying customer route internet traffic through someone’s home connection, so it appears to come from an ordinary household. There are legitimate uses for that, such as testing how a website looks in another country. It is also useful for anyone who wants to hide while running scams or attacking accounts, and the home user whose address is borrowed may never know.
The investigative startup Synthient, which bought and took apart infected hardware, says the devices included boxes sold under the MECOOL and YOKATV storefronts. It estimates about half a million machines are online at any given moment, with a heavy presence in Malaysia, Mexico and Brazil, and its researchers consider 1.3 million a conservative count. Infected products were not limited to TV boxes, either. Karaoke machines, digital signs and telehealth devices were also found carrying the code.
DailyShock has not tested these products independently. Oxylabs, whose software was among the proxy tools named in Google’s report, said that a developer had faked consent signals, and that it has suspended the supplier involved, which it says accounted for less than 1 percent of its address pool.
Why certification did not save buyers
Android device makers have to pass Google’s compatibility and security tests before shipping products with its apps. Google says the operators got around those checks by hiding the malicious behavior and loading it only after a user’s first boot. It has now changed its review process, added firmware checks and banned the manufacturer from making certified devices.
That detail matters for shoppers. Certification lowers your risk, but this case shows it is no guarantee.
What to do if you own a box like this
Synthient has published a list of affected model numbers on its public GitHub page. If yours is on it, or if you bought a no-name box and cannot tell who made it:
- Unplug it and stop using it. The researchers recommend getting rid of it. A factory reset is not a reliable fix when the backdoor lives in firmware.
- Change your Wi-Fi password and update your router, since an infected device has been sitting on your home network.
- Look over what else is connected. Disconnect any device you do not recognize.
- Be suspicious of bundled “free” streaming, and of any app that offers to pay you for your spare bandwidth. Google calls those a common way that proxy networks grow.
- Buy from known brands. Google maintains a public list of certified Android TV partners at android.com/certified/partners.
An unusually slow connection, or websites that keep asking you to prove you are human, can be signs that your address is being abused, but plenty of harmless things cause those too.
