Google says an Android device maker that supplied certified devices built malware into the set-top boxes it made, then sold access to them to criminals. In a report published this week, the Google Threat Intelligence Group said the backdoor, called XCPE, had pulled more than 1.3 million devices into a botnet before Google and its partners dismantled it the previous week.
The maker is Videostrong Technology Co., an Android device manufacturer that also designs devices for other brands. Google says it has cut ties with the company and banned it, and any future subsidiaries or affiliates, from building and selling certified Android devices or supplying software to certified vendors.
Contents
Quick facts
- More than 1.3 million set-top boxes were enrolled in the XCPE botnet, the overwhelming majority of them Android TV boxes, Google says.
- Google also found it on telehealth devices, karaoke machines and digital signage.
- Infected boxes were used for ad fraud, data exfiltration and routing other people's traffic through owners' home connections.
- Google assesses that taking down its affiliates' control servers will cut off at least 10 million more compromised devices.
- Malaysia is one of a handful of countries shaded in a darker blue on Google's map of where the backdoor was seen.
Where Malaysia sits on Google's map
The report includes a world map of where devices carrying the backdoor turned up. Most shaded countries are a pale blue. A handful are a darker blue, and Malaysia, both the peninsula and Sabah and Sarawak, is one of them. Neighbours such as Thailand and Indonesia are shaded in the paler tone. The map carries no legend, scale or figures, so it does not tell us how many boxes any country had. What Google does say about the darker patches is this: the botnet is "globally dispersed, with certain concentrations possibly implying market penetration for the brand distributor."
Google does not publish a count for each country. Nor does it name the brands Videostrong built for. It says only that the malware was "built directly into many different device models and brands over multiple years."
What the boxes were doing
According to Google, the backdoor sat in the device firmware with system-level access and reinstalled itself on reboot if a user removed it. Videostrong sold access to "criminal affiliates", whose add-on modules turned boxes into residential proxy exit nodes, ran ad fraud and loaded more malware. The backdoor could also switch off Google Play Protect's app checks, install apps silently, run commands and capture the screen.
Videostrong got past Google's compatibility and security tests by loading the malicious code only after a device's first boot, the report says. Google says it has changed its review process as a result.
What a box owner in Malaysia can check
Google's advice is to buy set-top boxes only from reputable manufacturers, using the partner list on its Android TV site, keep Google Play Protect switched on, and avoid apps that offer payment for "unused bandwidth" or "sharing your internet". To see whether a device is Play Protect certified, open the Play Store, tap the profile icon, then Settings and About, as set out on Google's help page.
That check has a limit. Videostrong was a Google partner whose devices went through Google's own tests, and it beat them. Our reading: certification shows a box passed Google's tests at the time, and this case shows a maker can pass them and still ship a backdoor.
We covered the legal side of pirate streaming boxes in Malaysia in an earlier piece on the penalties for selling one. And for another case of trusted-looking channels being abused, see our report on fake helplines hiding on government sites and in AI answers.
Google has not said which brands carried the backdoor, and its map gives no figure for Malaysia. Until it publishes either, owners here are working from Google's general advice above.
