Videostrong backdoored 1.3 million Android TV boxes
Original title: A hidden backdoor put 1.3 million TV boxes to work for criminals
Google discovered Videostrong backdoor in 1.3 million Android TV boxes that turned them into residential proxy botnet used by criminals.
Google’s Threat Intelligence Group says Videostrong Technology built and ran the XCPE backdoor in 1.3 million certified Android TV boxes. The backdoor has system-level privileges and sits in the firmware. If uninstalled it reinstalls from the /oem/ partition on reboot. Google took legal action to take down domains and servers. The takedown disrupted the botnet but the backdoor remains in infected boxes’ firmware.
Unconfirmed: Exact affected models not fully listed by Google
- - 1.3 million Android TV boxes affected
- - Backdoor called x.cpe or com.oemservice
- - Sold access to criminal affiliates
- - Allows IP address rental for fraud
- - Google banned Videostrong from certified devices
Impact: Residential proxy network and ad fraud via 1.3 million TV boxes
- 1.Disconnect affected TV box
- 2.Contact seller or manufacturer for replacement
- 3.Isolate on separate network
- Vendors
- Videostrong TechnologyGoogle
- Products
- Android TV boxes
- Malware
- XCPE
From the original article
3 min read at malwarebytes.com
Videostrong planted a backdoor in more than 1. 3 million Android set-top boxes and sold criminals access to the resulting botnet.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.