Google and partners dismantled the XCPE backdoor that enrolled more than 1.3 million Android set-top boxes in a botnet. Google assesses with high confidence that Videostrong Technology built and ran the malware for profit, selling access to affiliates for ad fraud, residential proxies and extra malware. Google cut ties with Videostrong, banned it from certified devices with preloaded Google apps and tightened firmware integrity checks. Partners included Japan’s National Police Agency and several security firms.

What it means: The case shows risk often starts with the firmware maker, not an app the user installs. Cheap Android TV boxes sold in retail can carry a persistent system-level backdoor that reinstalls after removal. Greek households and small firms using such boxes for signage or TV should stick to known Android TV partners and keep Play Protect on. Retailers and importers should demand independent ODM audits before shelf placement. Links to residential proxy networks explain why a living-room box can exit malicious traffic that implicates a business IP address. Security teams should watch odd outbound flows from IoT VLANs and keep set-top devices off corporate LANs. Google’s ban raises the cost of intentional supply-chain abuse, but lasting pressure needs marketplaces and ISPs to delist implicated brands quickly. Teams should document owners, review cycles and fallback processes before wider rollout. Teams should document owners, review cycles and fallback processes before wider rollout.

Read the original on Google Cloud Threat Intelligence

Related service: Custom software

Related stories