Affordable Android TV streaming devices have gained popularity as alternatives to pricier options from well-known brands. Many of these devices are produced in China and are sold in the United States under various brand names. Similar to traditional streaming devices, these boxes grant access to a range of popular streaming applications, but they also allow for easier installation of third-party software. This feature is appealing to users interested in viewing pirated content. If you’ve purchased one of these devices, you may have unintentionally acquired more than expected.
Recently, the Google Threat Intelligence Group took action against the XCPE botnet, which had over 1.3 million compromised Android TV streaming boxes. Google reported that the Chinese company Videostrong Technology intentionally embedded harmful backdoor software in these devices. This malware enabled cybercriminals to exploit the devices for ad fraud, redirect internet traffic through unsuspecting owners’ connections, and install additional harmful software without their consent.
The malware was pre-installed before consumer purchase
Videostrong Technology implicated by Google
Those who bought these devices did not need to download harmful applications or visit malicious websites to end up with malware. Videostrong Technology produces hardware and software for various streaming brands, and Google’s Threat Intelligence Group believes they “have high confidence” that Videostrong intentionally created and maintained the backdoor, rather than it being the act of an individual rogue developer.
Worryingly, some of these devices are even Google-certified. Google claims that Videostrong employed tactics to conceal the malicious code during security evaluations. The malware was designed to activate after the device’s initial boot, thus allowing the boxes to pass Google’s certification undetected. Google has indicated plans to enhance its review processes to prevent similar issues in the future.
This situation has been evolving for some time
Google noted that Videostrong has been developing this malware since at least late 2021. Following the investigation, Google has banned Videostrong and its partners from making Google-certified Android devices or supplying software to other certified manufacturers. This is a significant consequence, especially since some affected devices had previously passed Google’s certification.
Potential actions of hackers utilizing an infected Android TV box
Cybercriminals profiting from compromised devices
Adding to the severity of the situation, Google revealed that Videostrong was not only infecting devices but also selling access to them to other criminal organizations. These groups used the compromised devices to perpetrate advertising fraud, generating fake views and engagements with online ads to earn advertising revenue. The infected boxes were also utilized as proxies, allowing criminals to route internet traffic through the owner’s home connections. This made the illicit activities appear to be emanating from ordinary households, while the owners remained unaware that their internet connections were being exploited.
Hackers could also remotely install applications without the owner’s consent, and the backdoor could disable Google Play Protect, Android’s built-in security feature. This made it easier to clandestinely install harmful apps without triggering standard security warnings.
With the malware at their disposal, hackers could capture screenshots, simulate keystrokes, and gather sensitive information such as account details, installed applications, and system logs. They could issue remote commands and scan local networks for other interconnected devices. While not every infected device would engage in all these activities, it illustrates the extensive level of control these cybercriminals had.
Why a factory reset might not eliminate the malware
Designed to persist beyond factory resets
Initially, one might wonder if performing a factory reset could eliminate the malware. Unfortunately, the reality is more complex. Typically, a factory reset removes installed apps, personal data, and settings, returning the device to its original factory state. However, the XCPE backdoor was integrated into the device’s firmware, rather than simply being an application like other Android installations. According to Google, the backdoor could reintroduce harmful components after the device was rebooted, meaning that a simple reset wouldn’t resolve the issue.
Since the backdoor was embedded during manufacturing, restoring the factory settings could leave the malware intact. To completely remove it, one would need to replace the compromised firmware with a verified clean version, assuming such an option exists from a trustworthy source. Given that Google has banned Videostrong from its certification program, receiving a clean firmware update from them or any official source is highly unlikely.
Researchers at Synthient assessed the malware by acquiring a MECOOL KM9PRO Max and analyzing its software and firmware. Their findings indicated that the backdoor had system-level access and could reinstall malicious components even if they had been removed. For this reason, Synthient advises discarding devices confirmed to be infected instead of attempting to clean them, as there’s no guarantee that the devices aren’t still compromised.
Verify your device against the list of potentially infected models
The first action you should take is to locate your Android TV box’s model number. This information can typically be found under Settings > System > About or on a label on the bottom of the device. Synthient has published a list of 182 affected models. Compare your device against this list, keeping in mind that not all devices on the list are necessarily compromised.
If your model is listed, disconnect it from your home network while you conduct further investigations. You may contact the manufacturer to confirm if your specific device and firmware version is impacted and whether a verified clean firmware update is available. However, since the malware is intertwined with the firmware, replacing the device seems to be the best course of action.
