Security Flaw in Google-Certified Android TV Boxes Exposed
Assumptions regarding the security of Google-certified Android TV boxes may lead one astray; particularly, the notion that they are impermeable to malware is evidently misguided.
Recently, Google released an alarming Threat Intelligence report titled “Shutting the Door on the XCPE Botnet.”
The report highlights that as many as 1.3 million TV boxes have succumbed to the XCPE backdoor, converting these devices into components of a botnet exploited for financial gain.
According to Google’s analysis, there is a high degree of confidence that the malware was deliberately engineered, deployed, and maintained by Videostrong Technology, a manufacturer of TV boxes.
This entity had been previously reported on at a time when Android TV boxes were a burgeoning alternative to single-board computers (SBCs) operating on Linux.
Reportedly, Videostrong capitalized on the backdoor by permitting affiliates to implant malware modules on compromised devices, facilitating operations related to ad fraud, incorporation of TV boxes into residential proxy networks, and more.
In response, Google has initiated legal maneuvers to incapacitate the command-and-control (C2) domains overseeing these affiliate modules.
The tech giant estimates that this action will safeguard at least 10 million additional vulnerable devices from malware infiltration.
Furthermore, Google has severed its affiliation with Videostrong. While this termination does not preclude Videostrong from manufacturing and selling Android TV boxes, it bars the company from preloading Google applications onto these devices and revokes any certifications.
Initial security assessments failed to detect the embedded malware, largely due to obfuscation methods employed by Videostrong, which manipulated testing vulnerabilities to execute malicious code only following the device’s inaugural boot. In a bid to prevent recurrence, Google has revised its review protocols.
This nefarious scheme has reportedly persisted since late 2024 and features a tripartite architecture, supporting modules from numerous affiliates. The malware operates within the Android firmware as follows:
- Primary Backdoor – The x.cpe component is embedded in the firmware partition and automatically reinstates from the /oem/ partition upon user removal.
Its primary function is to enable communication with the C2 servers that have been dismantled, along with the loader and execution engine described subsequently. - Loader and Execution Engine – Identified as com.abc.nexus, this component configures and initializes monetization modules while employing anti-analysis tools to evade detection by sandbox environments.
It possesses the capability to download supplementary malware through a staging infrastructure. - Monetization Modules – These modules, created by external customers or affiliates rather than Videostrong directly, transform compromised devices into residential proxy nodes (such as Linkfog, AppSalt, NetNut), ad-fraud engines (like CBOXTV, HiddenView), or facilitate other monetization strategies. Each module interfaces with distinct “Module C2” servers that vary per affiliate.
Communications are conducted via HTTP and MQTT protocols. Google asserts that a substantial portion of the malware has been hosted on platforms like GitHub, alongside others on operator-controlled servers and file hosting services.
The Threat Intelligence report encompasses further technical specifics, along with a comprehensive list of services, websites, and GitHub repositories implicated.
While a significant number of TV boxes are affected by this issue, it appears that not all regions are similarly impacted.
Though Google has taken steps to mitigate the threat, the original firmware remains on the infected devices.
The sole rectification method involves flashing custom firmware for the TV box, assuming it exists. If you are a proprietor of a Videostrong or MECOOL device, it is prudent to assume your unit has been compromised.
The Synthient security firm has conducted specific tests on the MECOOL KM9Pro TV box and compiled a non-comprehensive list of infected devices, which is available on GitHub.
Appreciation is extended to itchy n scratchy and TLS for providing the initial tip-off.
Source link: Cnx-software.com.
