Google Cuts Off Videostrong Over Backdoor in 1.3M Android Devices

How the x.cpe backdoor worked

The malware, called x.cpe, shipped on the devices and was used to build a botnet known as XCPE. To get past the security tests Google runs during certification, it loaded malicious code only after a device's first boot. If a user removed it, it reinstalled itself on restart, and it could also disable Google Play Protect.

Google's investigation found attackers could capture screens remotely, inject key presses and send account information and system logs to outside servers. Videostrong sold access to third parties, who then pushed their own malware onto infected devices.

The most common abuse was turning devices into residential proxies, which route other people's traffic through a victim's home connection without their knowledge. One device carried up to three separate proxy programs. Google also found ad fraud that inflated view counts and the installation of additional malware.

Takedown and next steps

In the last week of October, Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, the AI security brand of Trend Micro, to disrupt XCPE. Servers and domains used to control the botnet and distribute malware were targeted, and legal action was taken against domains commanding the extra malware.

Because that malware also spread through other routes, Google expects the action to cut attacker access to at least 10 million additional devices infected another way.

To prevent a repeat, Google will revise its review process and strengthen checks for malicious code in the firmware of certified Android TV devices.