Buying an inexpensive Android TV box online seems like a hassle-free way to watch your favorite shows without spending much money. Google just shut down a massive cybercrime ring after discovering that more than 1.3 million of these budget Android TV-powered streaming devices were secretly working for hackers. Investigators found out that Chinese hardware maker Videostrong purposely built a backdoor into its firmware so criminals could rent access to infected homes.
The preinstalled malware, named x.cpe, ran with full admin rights to run fake ad clicks and route suspicious web traffic through everyday home connections. Security write-ups from Google’s Threat Intelligence Group and Trend Micro showed that remote operators could record keystrokes, grab screenshots, and scan other gadgets on the network. What makes the situation worse is that the malware turns off Google Play Protect and reinstalls itself every single time the device reboots.
Malicious firmware and proxy networks
Google joined forces with “Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI” to take down the control servers running the network. Most of the bad hardware reached buyers under the MECOOL brand or as unbranded streaming sticks. Cutting off those central control domains effectively knocked out remote access to over ten million compromised gadgets globally.
In response to the discovery, Google completely banned Videostrong from making certified Android devices or using official Google apps. Security teams noticed that Videostrong dodged initial certification checks by hiding its malicious code until long after the box finished its first startup. That major security oversight prompted Google to revamp how it tests and approves firmware from hardware partners.
Practical steps for home network security
Getting rid of the infection isn’t as simple as deleting a bad app since the code sits directly inside the read-only firmware memory. Researchers recommend that anyone using a suspicious MECOOL or off-brand streaming box should unplug it right away and replace it with trusted hardware. Network security teams also suggest keeping smart TVs and streaming boxes on a separate guest Wi-Fi network so they cannot reach personal laptops or work computers.
Knocking out the control servers stops hackers from sending new commands, but the dormant backdoor code will stay on those streaming boxes forever. Sticking to reputable device brands is still the easiest way to keep your home Wi-Fi safe from unwanted intruders.
The post Google Just Killed a Massive Android TV Botnet Hiding in Millions of Homes appeared first on Android Headlines.
