Google’s Threat Intelligence Group says Chinese firmware maker Videostrong built a backdoor into its software and sold access to infected devices to criminal affiliates.
The botnet, called XCPE, enrolled more than 1.3 million devices worldwide. Plume Security Labs mapped clusters of infections around Sydney, Melbourne, Brisbane, Perth and Adelaide.
What was infected
- Android TV streaming boxes, including MECOOL-branded boxes sold by Skyworth Technology
- telehealth devices
- karaoke machines
- digital signage.
What the botnet did
Operators used infected devices for ad fraud, to install more malware and as residential proxy exit points. They could also take screenshots, inject keystrokes, steal account details and open remote shells.
Takedowns of the botnet’s command servers are expected to cut off at least 10 million more compromised devices. Google has cut ties with Videostrong and barred it from building certified Android devices.
Advice
Buy connected devices from reputable manufacturers, and be wary of any app that offers to pay you for unused bandwidth.
