Google dismantles botnet secretly running on 1.3 million Android TV boxes
Google has cut ties with the company behind the botnet campaign.
Google has cut ties with the company behind the botnet campaign.
The short version
- Google’s Threat Intelligence Group says it has shut down a massive botnet called x.cpe.
- At its height, x.cpe ran on more than 1.3 million Android TV devices, and unusually, these were Google-certified boxes.
- Google says its screening process missed the malware due to “obfuscation techniques” employed by Shenzhen-based Videostrong Technology.
What happened
After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator’s behest.
Why it matters
It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious.
Summary by Nerd News Network. Read the full article at Ars Technica via the links above and below.