Google takes down a massive Android TV botnet, but infected devices remain dangerous

Google has taken down a huge Android malware operation that turned over 1.3 million Android TV boxes into weapons for cyber criminals.The company revealed that the operation was performed by Videostrong Technology, a device maker that has been accused of intentionally putting a hidden backdoor on its products and selling access to criminal affiliates.The malware, dubbed XCPE or x.cpe, was directly embedded in the firmware of Android TV boxes sold under different brands.

Google’s Threat Intelligence Group said that Videostrong developed the backdoor as a business, not letting it slip through accidentally.

Criminal partners could use infected devices to generate fake ad views, reroute internet traffic through unsuspecting homes, and install more malware.A backdoor that gives criminals control of your TV boxGoogle is particularly concerned about XCPE because it runs with Android system-level privileges.

It connects to remote command-and-control servers, enabling attackers to silently install applications, execute shell commands, take screenshots, and collect device information.Google also found that the malware could collect account information, application lists, and system logs.

Continue reading at the original source →