In a detailed blog post, the Threat Intelligence Group explains how the x.cpe botnet evolved quickly from a single-stage dropper into a modular three-stage malware platform that sold access to third parties. Manufacturers must have their devices certified if they want access to Google apps and branding, a process that is supposed to catch threats like this. However, Videostrong’s compromised boxes, mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online.
[...]
Google found most of the boxes were running residential proxies for routing large volumes of nefarious traffic or modules that engaged in ad fraud schemes. Selling access to this botnet was probably a big business. Videostrong also had full access to the devices, allowing operators to run terminal commands, capture the screen, and probe other devices on the local network. Google reportedly observed Videostrong doing this in real time.
[...]
Synthient has published a list of 182 device model names known to be included in the botnet. Anyone who has purchased a MECOOL or white label Android TV box of unknown origin should check it. Trend Micro counted a total of 1,472,554 infected devices, somewhat higher than Google’s estimate. The overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.
Google determined the operation was not the work of a rogue actor, so it has ended its relationship with Videostrong. The company, as well as any subsidiaries, will not be permitted to use Google’s Android apps and services.
Google also notes that it is updating its certification process to close the loophole that allowed Videostrong to operate its botnet on certified devices. Android is open source, though, and there are countless uncertified Android-based TV boxes out there. Videostrong could continue to sell malicious hardware under other brands without Google apps. But it would still have to rebuild its malware operation from scratch.
From the article:
[...]
[...]