A set-top box plugged in beside a living-room television can quietly sell its owner’s home internet connection to strangers. Google says that is what a Chinese manufacturer built into more than 1.3 million Android TV devices, and that it has now taken down the infrastructure behind the scheme.
In a report published November 2, Google’s Threat Intelligence Group said it assesses with high confidence that Videostrong Technology Co., an Android device maker, deliberately developed and operated a backdoor it calls XCPE. Google worked with industry partners to dismantle it, cut ties with the company and banned it from making devices with preloaded Google apps.
The company says the backdoor was sold on to criminal affiliates. Their software turned infected devices into residential proxy exit nodes, which let paying customers route traffic through an ordinary home connection, and into engines for advertising fraud. Google also says the malware could load further malware, capture screenshots and run commands. These are Google’s findings, based on its own analysis, and have not been tested in court.
The scale may be larger than the headline number. Google estimates that disrupting the affiliates’ control domains will cut access to at least 10 million additional compromised devices, because those affiliates distribute their software through other channels as well. Ben Brundage, founder of the proxy-tracking firm Synthient, told KrebsOnSecurity that the 1.3 million figure is highly conservative. That is an estimate of lost access for the criminals, not a count of devices that have been cleaned.
The malware was built into the firmware. Google says one component reinstalled itself after a user removed it, and that the code switched off Google Play Protect checks so it could install further software without consent. Google adds that Videostrong used obfuscation to load malicious code after a device’s first boot, exploiting a gap in the compatibility tests Android manufacturers must pass. The company says it has since changed its review process.
Google named a number of proxy and advertising-fraud services whose software appeared on infected boxes, including AppSalt, which it says belongs to Honeygain and is owned by Oxylabs. Oxylabs did not respond to KrebsOnSecurity’s request for comment. Google said another named provider, NetNut, had already been the subject of an earlier disruption. Being named in Google’s technical report is not the same as a finding of wrongdoing by a court.
The takedown involved several outside partners. Google credits Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI with helping analyse and disrupt the operation.
Synthient published a separate report on the same day. According to KrebsOnSecurity, it concluded that a popular box sold under the MECOOL brand by the publicly traded Chinese company Skyworth Technology also carried Videostrong’s malware and proxy components. The Eastern Herald has not seen a response from Skyworth, and the finding rests on Synthient’s analysis.
Most infected devices were Android TV boxes, but Google also found the malware on other Android-based hardware, including telehealth devices, karaoke machines and digital signage. That matters for buyers who assume a product sold through a mainstream retailer has been vetted by someone else.
Google itself cautions that the work is not finished. It describes backdoor operators, ad-fraud rings and proxy providers as an interconnected supply chain, and says operators move quickly to new loaders when one part is disrupted. Its advice to consumers is to buy connected devices only from reputable manufacturers, to be wary of apps that pay for unused bandwidth, and to keep Google Play Protect on.
The unresolved question is what happens to the boxes already in homes. A takedown cuts the criminals’ control, but it does not tell owners whether their device is affected, and Synthient has published a list of affected models for people who want to check.
