Google Dismantles XCPE Botnet of 1.3 Million Android Devices

What it is

XCPE (also X.CPE) is a backdoor and botnet on more than 1.3 million Android devices, built and operated by Videostrong Technology, a China-based OEM/ODM. Google announced the takedown on a Monday (the page gives no date). Google says it was a deliberate operation by the company, not a rogue insider or a development oversight. Videostrong sold access to affiliates, who loaded malicious modules for ad fraud, data exfiltration, residential proxying and further malware loading.

How it works

The malware was built into many device models and brands over several years. It had three stages: a primary backdoor persisting on the /oem/ partition, a loader and execution engine, and monetization modules that could run additional backdoors and load more modules.

Videostrong passed Google's OEM compatibility and security tests by using obfuscation to exploit a gap in them. The malicious code was loaded after the device's first boot, so it was not present when the tests ran.

Preconditions / Affected

Most infected devices are Android TV set-top boxes. Google also saw other Android-based IoT devices: telehealth devices, karaoke machines and digital signage. The infection ships with the device, so affected units are those from Videostrong or built on its firmware. The page names no models, brands or indicators of compromise.

What to do

The page gives no remediation steps or detection queries. Google's actions were legal: it took down the botnet's domains and servers, and the command-and-control domains behind the extra modules. This likely cut off at least 10 million other devices, because the module operators had spread their malware beyond XCPE. Google also banned Videostrong from making devices with preloaded Google apps.

Technical write-ups were published by Plume (PDF), Synthient and TrendAI. An engineer who needs indicators or device lists should look there. Other partners were Japan's National Police Agency, Lumen and Human Security.

Caveats

Google says the illicit market is resilient. Backdoor operators, ad-fraud rings and residential proxy providers work as an interconnected supply chain, and operators quickly move to new loaders or rival monetization SDKs when one part is disrupted. Google believes it seriously affected over a dozen malicious actors.