Google has dismantled a botnet of more than 1.3 million Android devices, most of them TV set-top boxes. But the shutdown doesn’t remove the hidden backdoor from affected hardware, and even a factory reset won’t fix it.
According to Google’s account of the operation, Chinese device manufacturer Videostrong deliberately embedded the backdoor in the firmware of its own-brand consumer products, intending to sell access to criminal groups. Called “x.cpe,” the backdoor let operators remotely install malicious apps, take screenshots and monitor keystrokes.
This wasn’t simply a malicious app that an owner might unknowingly download. Over the years, x.cpe was included as a system application across numerous device types and brands. Users weren’t necessarily aware it was there, and deleting the application wasn’t enough: the backdoor reinstalls itself after a reboot.
The affected hardware was primarily Android TV boxes, the smart media players that plug into televisions. But the problem extended beyond the living room. Other affected devices included, for example, telemedicine equipment, karaoke systems, and digital advertising and information displays.
Google says Videostrong used obfuscation to install malicious code after the first boot, bypassing the checks that had allowed the manufacturer to supply certified Android devices. Google has since ended its relationship with Videostrong and prohibited the company from manufacturing certified Android devices or supplying software to other Android device manufacturers.
Disrupting the botnet isn’t the same as cleaning the devices. The operation targeted the network’s control infrastructure, not the backdoor embedded in consumers’ hardware. As The Hacker News also reported, taking that infrastructure down doesn’t remove the persistent infection.
Security company Synthient recommends that owners retire affected devices rather than try to recover them, because a factory reset doesn’t solve the problem. Its researchers have published a list of 182 affected device models that owners can check for their hardware.
