Google Disables XCPE Backdoor on 1.3 Million Android TV Boxes
Google, working with Japan's National Police Agency and security firms, has neutralized the XCPE backdoor on more than 1.3 million set-top boxes and cut ties with maker Videostrong.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesGoogle said on November 3 (US time) that it has disabled the XCPE backdoor on more than 1.3 million set-top boxes, working together with Japan's National Police Agency and several security companies.
XCPE (x.cpe) is malware built into devices made by Videostrong Technology, an Android OEM/ODM manufacturer. It could switch off Google Play protections, allow remote control, run ad fraud, turn a user's internet connection into a residential proxy and install further malware. The code was written directly into device firmware and managed through dedicated infrastructure with dynamic configuration to evade detection. Videostrong sold access to the backdoor to make money from it.
Which devices were affected
Most infected units were Android TV set-top boxes, but the list also includes Android-based IoT devices such as telemedicine terminals, karaoke machines and digital signage. Together they formed a botnet across North America, South America, Australia, Russia, Southeast Asia, Europe and parts of Africa.
Besides the National Police Agency, Google worked with Lumen, HUMAN Security, Plume, Synthient and TrendAI to dismantle the botnet and take legal action. The group also took down command-and-control (C2) domains used to distribute malware through the backdoor. Google estimates that, including routes beyond XCPE, access for more than 10 million devices was cut off.
Consequences for Videostrong
Google has ended its partnership with Videostrong and permanently barred the company, its subsidiaries and affiliates from making or selling certified Android devices and from supplying software to other vendors. It will also tighten existing review processes and revisit the verification steps that guarantee firmware integrity on Android TV devices.
The company cautioned that the job is not finished. Backdoor operators, residential proxy providers and ad-fraud groups form a complex supply chain, so dealing with them requires continued tracking of their infrastructure.
For consumers, the case shows that low-cost streaming boxes and other Android-based gadgets can arrive with malicious code already in the firmware, where ordinary app-level protections cannot reach it.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
