Videostrong backdoor powers 1.3M Android TV box botnet
Original title: Cops bust botnet of 1.3M infected Android TV boxes
Coalition disrupts XCPE backdoor in Videostrong devices infecting 1.3M Android boxes across 200 countries.
A coalition including Google, Lumen, Human Security, Plume, Synthient and TrendAI working with Japan’s National Police Agency disrupted the XCPE backdoor in Videostrong Android TV boxes. The manufacturer is accused of intentionally embedding the backdoor in firmware for financial gain and selling access to criminal affiliates. When devices connect to home networks the backdoor creates proxy networks and allows remote control via MQTT to install malware without customer knowledge. Between June 3 and October 1 TrendAI logged more than 3.8 million distinct home and mobile IP addresses connected to the operation. The coalition also disrupted command-and-control domains and Google banned Videostrong from making devices with preloaded Google apps.
Unconfirmed: Videostrong did not respond to inquiries about the claims
- Backdoor sold to criminal affiliates
- 3.8 million distinct IP addresses documented
- Command-and-control domains disrupted
- Google banned Videostrong from Google app preloads
Impact: Remote control of infected devices and installation of additional malware
- 1.Upgrade to devices without preloaded backdoors
- Products
- Android TV boxesprojectors
- Threat actors
- Videostrong Technology
- Organizations
- Japan’s National Police Agency
- Countries
- 200 countries
From the original article
2 min read at theregister.comVideostrong accused of shipping devices with a backdoor baked in
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.