Google led a takedown disrupting a 1.3M Android device botnet centered on TV set-top boxes.
Google concluded with high confidence that hardware maker Videostrong intentionally embedded an x.cpe system-level backdoor into firmware over several years to sell criminal access.
The problem mainly affects internet-connected television sets, known as set-top boxes, but also other devices such as karaoke machines, telemedicine equipment and digital display screens. Videostrong, based in Shenzhen, China, has been embedding the hidden program in many models and brands of devices for several years.
How the secret program worked
The program, known as x.cpe, operated in secret with full system access to devices and disabled security checks in Google's app store. This allowed attackers to install apps without the user's knowledge, execute commands, view the screen, record keystrokes, and remotely control devices.
Most of the network was used to sell unused internet connections and turn users' homes into traffic hubs for others, while another part of it was used to generate fake traffic for online advertisements.
The dislocation operation and the consequences
In late October, Google used legal means to take down the servers controlling the network, working with Japanese police and several security companies. As a result, Google permanently terminated its partnership with Videostrong, prohibiting the company and its subsidiaries from manufacturing or selling certified Android devices.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Cyberattack on European supermarkets raises refrigerator temperatures, destroys food
↗
Researchers recorded millions of infected devices in multiple countries, with higher numbers in Malaysia, Brazil, Iraq, Mexico and Taiwan, while countries such as the United States, Germany, Britain, Australia and Canada had tens of thousands each.
What users can do
Despite the shutdown of the central servers, the hidden program remains deeply rooted in the device software and automatically reappears after each reboot. Users cannot remove it themselves. Some experts recommend permanently replacing the devices due to the high security risk, while others recommend restoring them to factory settings.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)