Redakcja Choose TV
Google has revealed a serious security problem with Android TV set-top boxes. More than 1.3 million devices were incorporated into a botnet that allowed cybercriminals to use them without their owners' knowledge. Most surprisingly, the malware was reportedly deliberately installed by the manufacturer itself, and some devices even had an official Google certificate.
Manufacturer deliberately installed malware
According to Google Threat Intelligence Group, the operation has been attributed to the Chinese company Videostrong Technology, which manufactures TV set-top boxes, including under the Mecool brand.
A backdoor named XCPE was hidden in the devices' software, allowing remote installation of applications, data exfiltration and the use of the home internet connection for illegal activities. The infected set-top boxes were used, among other things, for ad fraud and redirecting internet traffic.
Interestingly, some devices held Google Play Protect certification. The malware evaded security checks because its additional components were only downloaded after the device's first startup.
Google responds. What about users?
Google, together with partners, has blocked the infrastructure used to control the botnet. The company has also cut ties with Videostrong, forbidding the manufacturer from producing Google-certified devices that include Google services.
However, this does not mean the problem has completely gone. The malicious software may still reside in the memory of infected devices, and it cannot always be removed by ordinary means.
Users of Mecool set-top boxes or other devices from Videostrong should check their model and whether secure firmware is available. If an infection is suspected, it is best to disconnect the box from the internet and contact the manufacturer.
It is worth emphasising that the issue concerns specific devices and their firmware, not all Android TV or Google TV televisions.
Sources: FlatpanelsHD, Google, Malwarebytes
