Redakcja Choose TV
Google has revealed a serious security issue with Android TV set-top boxes. More than 1.3 million devices were added to a botnet that allowed cybercriminals to exploit them without the owners' knowledge. Most surprising of all, the malware was reportedly deliberately installed by the manufacturer itself, and some devices even carried an official Google certificate.
The manufacturer deliberately installed malware
According to Google Threat Intelligence Group, the operation is attributed to the Chinese company Videostrong Technology, which produces TV boxes under brands including Mecool.
A backdoor called XCPE was hidden in the devices' software, allowing remote installation of apps, data interception and use of the home internet connection for illegal activities. Infected boxes were used, among other things, for ad fraud and redirecting internet traffic.
Interestingly, some devices even had Google Play Protect certification. The malware evaded security checks because its additional components were only downloaded after the box's first start-up.
Google responds. What about users?
Google, together with partners, has shut down the infrastructure used to manage the botnet. The company has also ended its partnership with Videostrong, banning the manufacturer from producing Google-certified devices with Google services.
However, this does not mean the problem has completely gone. The malware can still reside in the memory of infected devices, and simply removing it is not always possible.
People using Mecool set-top boxes or other devices from Videostrong should check their model and the availability of secure software updates. If you suspect an infection, it’s best to disconnect the box from the internet and contact the manufacturer.
It’s worth stressing that the matter concerns specific devices and their software, not all TVs running Android TV or Google TV.
Sources: FlatpanelsHD, Google, Malwarebytes
