A Backdoor Built Into the Box

The box under a television is usually the last thing anyone thinks about. It streams video, it was cheap, and it was certified. According to Google, more than a million of those boxes shipped with a backdoor written into their firmware — and the company that made them, Google says, put it there on purpose and sold access to it.

The operation ended in late October, when Google took down the domains and servers controlling the botnet. The devices did not go anywhere. The backdoor is still on them.

Google points at Videostrong

Google says it is highly confident that Videostrong, a Shenzhen-based maker of Android TV boxes and other devices, intentionally built a backdoor called x.cpe into its hardware and sold criminal access to it. The company builds products under its own name and for other brands.

Google does not believe a rogue insider or a simple mistake explains the backdoor's presence. The company used legal action to seize the domains and servers that ran the botnet, and it also took down the control domains of more than a dozen malware families that were loaded onto devices through the backdoor.

The takedown was a joint effort. Japan's National Police Agency worked alongside Lumen, HUMAN Security, Plume, Synthient and TrendAI, according to Google.

Google has cut ties with Videostrong. It banned the company — and any future subsidiaries or affiliates — from building or selling certified Android devices, and from supplying software to other certified device makers.

What the implant could actually do

According to Google's analysis, x.cpe runs as a system app inside the firmware with system-level access. It reports back to the botnet's command-and-control servers and waits for instructions.

Before installing anything, it turns off the app checks in Google Play Protect, Android's built-in security feature. That lets the operators push apps onto a device without the owner knowing.

The capabilities Google describes go well beyond silent installs. Operators could run commands, capture the screen, and map the network the box sits on. Google says it observed Videostrong's operators using some of these powers directly: taking live screenshots, sending keystrokes, copying out account details, device information, app lists and system logs, and opening reverse shells that gave them a remote command line into the box.

Most of the criminal modules loaded through the backdoor turned the boxes into residential proxies or sold off their spare bandwidth. A residential proxy service sells access to a home internet connection so that a customer's traffic appears to come from an ordinary household. Other modules faked views of online advertisements.

The infected population is mostly Android TV set-top boxes, but the backdoor also turned up on telehealth devices, karaoke machines and digital signage.

TrendAI counts 1.47 million devices

TrendAI, Trend Micro's enterprise business unit, counted 1,472,554 infected devices across 206 models between June 3 and October 1. It says the real figure is at least that high.

• 1,472,554 infected devices counted by TrendAI across 206 models, between June 3 and October 1
• 182 device model names published by Synthient as seen in the campaign
• 10 million additional infected devices Google expects the action to cut off from the criminals behind the malware
• 26,000 to 42,000 devices each in the U.S., Germany, the U.K., Australia and Canada

Malaysia, Brazil, Iraq, Mexico and Taiwan had the highest concentrations of infected devices.

The evidence pointing to the maker

In Google's account, x.cpe passes settings from the command-and-control server to other Videostrong apps, including its YokaTV Player streaming app. One of the GitHub accounts that hosted the botnet's packages is named yf-videostrong.

Synthient, which worked with Google on the operation, reached the same conclusion with high confidence. It points to a document signed by Videostrong's research and development director that sat in an open folder on one of the botnet's servers, and to a Videostrong web domain that shares an IP address with the operators' control panel.

Plume, which makes Wi-Fi software for internet providers, found that Videostrong supplies both the firmware for these devices and the tools used to manage them remotely. Plume also identified more than a dozen different devices connecting to the botnet's control server, most of them from the MECOOL brand.

Synthient's report focuses on MECOOL-branded boxes, which it links to Videostrong. It bought a MECOOL KM9PRO Max and found the backdoor preinstalled. Its a list of 182 device model names covers models seen in the campaign, with a caution that a model name alone does not confirm a box is infected.

Removal does not stick

Because x.cpe is part of the firmware, removing it does not last. It reinstalls itself when the box restarts.

TrendAI says the backdoor runs as a system app signed with the maker's key, which means cleanup requires "vendor action, platform protection or replacement of the device."

— TrendAI, Trend Micro's enterprise business unit

Plume recommends a full factory reset because the modules may have installed additional backdoors, but it does not say whether a reset removes x.cpe itself. Synthient goes further, telling consumers to throw the boxes away permanently because they pose a high risk of malware.

For organizations, Synthient recommends four steps:

• Use its published indicators to find MECOOL or similar devices on the network.
• Disconnect and throw away any that turn up.
• Block the control domains and IP addresses its report lists.
• Keep other smart devices on separate network segments, away from sensitive systems.

TrendAI advises companies with remote staff to treat unmanaged consumer devices on home networks as part of their attack surface, and to keep corporate access behind managed devices.

The gap in Google's testing

Google requires device makers to pass a set of compatibility and security tests. It says Videostrong hid its code to bypass a gap in those tests, loading the malicious code after a device's first boot.

Google has changed its review process and is improving its checks of firmware on certified Android TV devices.

As of November 2, Videostrong's own website listed products it calls "Google Certified Android TV Box" and "Google Certified Android TV Stick." Plume says the botnet included both Google-certified devices and devices running the Android Open Source Project (AOSP) version. Google's report does not say how many certified devices were affected.

Google's earlier legal action against the sued over the BadBox 2.0 botnet involved more than 10 million devices, all of them uncertified.

Why it matters

Google expects the takedown to cut off the criminals' access to at least 10 million more infected devices, because the same operators spread their malware through other channels too. The company warns that backdoor operators and the criminals who buy from them quickly switch to new tools when one part of their setup is disrupted — which suggests the disruption is a setback rather than an ending.

For anyone running one of these boxes, the advice from the researchers who examined them is not reassuring. The backdoor is signed with the manufacturer's key and reinstalls itself across reboots, so a factory reset may not be enough. Synthient's recommendation to discard the devices entirely, and its list of model names to check against, may be the most practical guidance available to owners.

For organizations, the case suggests that unmanaged consumer hardware on home or branch networks deserves the same scrutiny as any other endpoint. Segmenting smart devices, inventorying what actually sits on a network, and keeping corporate access behind managed devices are the controls the investigators describe — and they matter more when the vendor itself is the party Google has accused.