Google and industry partners took down the XCPE backdoor botnet, which enrolled more than 1.3 million Android set-top boxes — mostly under Shenzhen manufacturer Videostrong's own and other brands — before control infrastructure was dismantled in late October. Google says it is "highly confident" Videostrong intentionally built the x.cpe backdoor into firmware as a system app over several years and monetised it by selling access to criminal affiliates who loaded malware modules for ad fraud and routing other people's traffic through owners' home connections; it does not believe a rogue insider or mistake was to blame. Through the backdoor, operators could silence Play Protect checks, silently install apps, run commands, capture screens and keystrokes, copy account data and open reverse shells. Google took legal action against the control domains and servers, also cutting off more than a dozen malware families loaded through the backdoor and estimating the action severs access to at least 10 million more infected devices; it has banned Videostrong and its affiliates from building certified Android devices. The backdoor remains on the boxes, and owners cannot remove it themselves.

• Source article