conv.

All stories
SecurityQuiet 5d · day 6

Google bans Android TV maker Videostrong after exposing 1.3M-device backdoor botnet

Google and security partners dismantled the x.cpe botnet, accusing manufacturer Videostrong of building a firmware backdoor into millions of set-top boxes for profit.

newest coverage 4d agosummary written 5d ago101 pieces208 likes & upvotes25 comments MastodonNewswiresHacker NewsLobstersGoogle NewsRedditXBluesky

What to know

  • Google says manufacturer Videostrong built the x.cpe backdoor directly into firmware across 206+ device models over multiple years, mostly Android TV set-top boxes but also telehealth devices, karaoke machines and digital signage.
  • The backdoor still resides on already-infected devices and owners cannot remove it themselves; Google's takedown targeted the botnet's control infrastructure, not the devices.
  • Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, and expects the action to cut off criminal affiliates' access to at least 10 million additional compromised devices.
  • Google has banned Videostrong and any future subsidiaries or affiliates from building or selling certified Android devices or supplying software to other certified manufacturers.

“backdoor and botnet were intentionally developed, deployed, and operated for financial gain”

Google, company statement · The Verge ↗ · Nov 1

Google Discovered and disrupted the botnetVideostrong Technology Co. Android device manufacturer accused of building the backdoorTrendAI (Trend Micro) Security research unit that tracked infectionsSynthient Botnet/proxy-network trackerJapan's National Police Agency Law enforcement partner

Google bans Android TV maker Videostrong after exposing 1.3M-device backdoor botnet
theverge.com

How it unfolded 3 developments, newest first · click a bar or a number to jump articlesposts

Peak 31 pieces in two hours at Nov 3, 4 AM; 97 pieces over 6 days (55 articles · 42 posts) Nov 2, 12 PM — 8 pieces · 6 articles · 2 posts — Google News 5, Mastodon 2, Newswires 1Nov 2, 2 PM — 11 pieces · 9 articles · 2 posts — Google News 6, Mastodon 4, Newswires 1Nov 2, 4 PM — 6 pieces · 2 articles · 4 posts — Google News 2, Mastodon 2, Hacker News 1, +1 moreNov 2, 6 PM — 1 piece · 1 post — Hacker News 1Nov 2, 8 PM — 3 pieces · 2 articles · 1 post — Google News 1, Mastodon 1, Newswires 1Nov 2, 10 PM — quietNov 3, 12 AM — 4 pieces · 1 article · 3 posts — Hacker News 2, Mastodon 1, Google News 1Nov 3, 2 AM — 2 pieces · 1 article · 1 post — Reddit 1, Newswires 1Nov 3, 4 AM — 31 pieces · 20 articles · 11 posts — Newswires 20, Mastodon 7, X 3, +1 moreNov 3, 6 AM — 3 pieces · 3 posts — Mastodon 3Nov 3, 8 AM — quietNov 3, 10 AM — 8 pieces · 6 articles · 2 posts — Google News 4, Hacker News 1, Bluesky 1, +2 moreNov 3, 12 PM — 1 piece · 1 article — Newswires 1Nov 3, 2 PM — 1 piece · 1 article — Google News 1Nov 3, 4 PM — quietNov 3, 6 PM — 2 pieces · 2 posts — Mastodon 1, Hacker News 1Nov 3, 8 PM — 2 pieces · 1 article · 1 post — Bluesky 1, Mastodon 1Nov 3, 10 PM — 1 piece · 1 post — Bluesky 1Nov 4, 12 AM — quietNov 4, 2 AM — quietNov 4, 4 AM — 2 pieces · 2 articles — Google News 2Nov 4, 6 AM — 2 pieces · 2 posts — Mastodon 1, Hacker News 1Nov 4, 8 AM — 1 piece · 1 post — Hacker News 1Nov 4, 10 AM — 1 piece · 1 article — Newswires 1Nov 4, 12 PM — 1 piece · 1 article — Newswires 1Nov 4, 2 PM — quietNov 4, 4 PM — 1 piece · 1 post — Mastodon 1Nov 4, 6 PM — quietNov 4, 8 PM — quietNov 4, 10 PM — 1 piece · 1 article — Google News 1Nov 5, 12 AM — quietNov 5, 2 AM — quietNov 5, 4 AM — quietNov 5, 6 AM — quietNov 5, 8 AM — 1 piece · 1 post — Mastodon 1Nov 5, 10 AM — quietNov 5, 12 PM — quietNov 5, 2 PM — quietNov 5, 4 PM — quietNov 5, 6 PM — quietNov 5, 8 PM — quietNov 5, 10 PM — quietNov 6, 12 AM — 1 piece · 1 post — Mastodon 1Nov 6, 2 AM — 1 piece · 1 post — Bluesky 1Nov 6, 4 AM — quietNov 6, 6 AM — quietNov 6, 8 AM — quietNov 6, 10 AM — 1 piece · 1 post — Mastodon 1Nov 6, 12 PM — quietNov 6, 2 PM — quietNov 6, 4 PM — quietNov 6, 6 PM — quietNov 6, 8 PM — quietNov 6, 10 PM — quietYesterday, 12 AM — quietYesterday, 2 AM — quietYesterday, 4 AM — quietYesterday, 6 AM — quietYesterday, 8 AM — quietYesterday, 10 AM — quietYesterday, 12 PM — quietYesterday, 2 PM — quietYesterday, 4 PM — quietYesterday, 6 PM — quietYesterday, 8 PM — quietYesterday, 10 PM — quietToday, 12 AM — quietToday, 2 AM — quietToday, 4 AM — quietToday, 6 AM — quietToday, 8 AM — quietToday, 10 AM — quietToday, 12 PM — quiet 1–3
Nov 3Nov 4Nov 5Nov 6yesterdaynow · 1:54 PM ET
  1. 3

    Security researchers publish affected device models

    Synthient published a list of 182 device model names linked to the campaign, focusing on MECOOL-branded boxes tied to Videostrong, while warning that a model name alone does not confirm infection.

    “Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices.”
    — Google, company statement · source
    1. 10 outlets Google bans TV box maker over 1.3M-device XCPE botnet

      first by 2-Spyware, 5d ago · also Metacurity, Help Net Security, CyberInsider, Cyber Security News, SecurityWeek, eSecurity Planet +3

      9 more headlines
    • briankrebs

      New, by me: Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud…

      briankrebsMastodon5d ago41▲view on Mastodon ↗
    2 more of the top 3 · 15 posts in this stretch
    • geekwithsoul.bsky.social

      I hate the framing of this headline. If @arstechnica.com was better at their job, it would read, "Google tries to save face by shutting down a huge botnet it allowed to be created" (the TV boxes were all Google-Certified)

      geekwithsoul.bsky.socialBluesky5d ago2▲view on Bluesky ↗

    • ‼️ BREAKING - Google disrupts a 1.3 million-device Android botnet and bans TV box maker Videostrong. Google says the company deliberately built a backdoor into its devices and sold access to criminals. The control servers are down. The backdoor is still there. Full story:

      @thehackersnewsX5d agoview on X ↗
    all of them →
  2. 2

    The Register frames the action as a law-enforcement bust

    The Register covered the joint operation involving police and security partners, describing Videostrong as accused of shipping devices with the backdoor built in from the start.

    “Videostrong accused of shipping devices with a backdoor baked in…”
    — The Register
  3. 1

    BleepingComputer details the XCPE botnet dismantling

    BleepingComputer reported that Google and industry partners dismantled the XCPE malware botnet of more than 1.3 million Android TV boxes, which Google says its manufacturer intentionally infected to generate cybercrime revenue.

    “Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities.”
    — BleepingComputer
    1. 14 outlets Cops Bust Botnet of 1.3 Million Android TV Boxes

      first by Slashdot, 5d ago · also TechRadar, The Register, Techaeris, The Verge, Ars Technica, PR Newswire Canada +7

      8 more headlines
    2. 3 outlets Google shuts the door on XCPE Botnet

      first by Advanced Television, 5d ago · also Google Cloud, McAfee

      2 more headlines
    • BleepingComputer@infosec.exchange

      Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. https://www. bleepingcomputer.com/news/secu…

      BleepingComputer@infosec.exchangeMastodon6d agoview on Mastodon ↗
  4. background

    Google discloses backdoor, bans manufacturer Videostrong — Google said Videostrong intentionally built the x.cpe backdoor into 1.3 million devices and sold access to criminal affiliates for financial gain, and banned the company from building or selling certified Android devices or supplying software to other manufacturers.

  5. background

    Google leads takedown of the botnet's control servers — In late October, Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI to use legal action to seize the domains and servers controlling the x.cpe botnet and more than a dozen malware families loaded through it.

  6. background

    Researchers begin tracking mass infections across Android TV boxes — TrendAI, Trend Micro's enterprise unit, counted 1,472,554 infected devices across 206 models between June 3 and October 1, and said the true number was likely higher.

Also covered reported alongside — the timeline has no entry for these yet

  1. 4 outlets Google takes down a massive Android TV botnet, but infected devices remain dangerous

    first by Android Central, 5d ago · also CyberScoop, Digital Trends, Sixteen:Nine

    3 more headlines
  2. 2 outlets Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

    first by Krebs on Security, 5d ago · also Security Affairs

    1 more headline

and 1 smaller piece

What people are saying 9 voices from 2 sites · best of 16 · verbatim