Break the botnet
Google worked with several other organizations to disrupt the x.cpe network, including the Japanese National Police, Synthient, and Trend Micro. Google says it has filed a lawsuit to shut down the domains and servers Videostrong uses to exploit and install its malware. It also attacked command-and-control servers operated by Videostrong and connected to other malware campaigns. Google estimates that Videostrong was cut off from approximately 10 million compromised devices.
This action should make affected devices safe to use, but probably not as safe as they should be. Play Protect is still disabled and inert malware modules are still installed. Since they are loaded as system apps, users cannot delete them easily.
Synthient released a list of 182 device model names known to be included in the botnet. Anyone who has purchased a MECOOL or white label Android TV box of unknown origin should check it. Trend Micro counted a total of 1,472,554 infected devices, slightly higher than Google’s estimate. The overwhelming majority were in Brazil, Malaysia, Iraq, Mexico and Taiwan, but tens of thousands of people were also online in the United States, Germany, the United Kingdom, Australia and Canada.
Google determined that the operation was not the work of a rogue actor and therefore terminated its relationship with Videostrong. The company, as well as its subsidiaries, will not be allowed to use Google’s Android applications and services.
Google also notes that it is updating its certification process to close the loophole that allowed Videostrong to operate its botnet on certified devices. However, Android is open source and there are countless uncertified Android-based TV boxes. Videostrong could continue to sell malicious material under other brands without Google apps. But it would still need to rebuild its malware operations from scratch.
Gn tech
