Google and security partners said Monday they disrupted a botnet hidden in more than 1.3 million TV set-top boxes. The November 2 announcement describes devices that arrived with malicious software already embedded in their firmware, letting operators exploit household internet connections without owners' consent.
Google's Threat Intelligence Group attributes the XCPE operation to Videostrong Technology, a manufacturer that supplies Android devices and software to other brands. Google says it cut ties with the company and barred it and future affiliates from making certified Android devices or supplying software to certified vendors.
The company says the malware supported advertising fraud, data theft and unauthorized traffic routed through people's connections. Operators could install software silently, capture screens and issue remote commands. Google says Videostrong concealed the code to get past security testing, then loaded it after a device's first boot.
Disruption does not clean the device
TrendAI's researchers, who participated in the operation, say taking down the control servers cuts off the operator but leaves the implant on devices already sold. Owners cannot remove it as an ordinary app; remediation requires vendor action, platform protection or replacing the device.
TrendAI counted 1,472,554 infected devices across 206 models in telemetry collected between June and October. Its observations included the United States. It says partners' totals differ because their measurement windows and visibility differ; the joint figure is more than 1.3 million devices worldwide.
The researchers advise consumers to avoid unbranded or uncertified Android TV boxes and apps that pay users to share bandwidth. Their warning concerns affected hardware and software, not every Android TV device.
Google says its action also targeted control domains used by criminal affiliates, estimating that disruption could sever access to at least 10 million additional compromised devices distributed through other channels. That is a separate estimate, not 10 million additional XCPE TV boxes.
The operation took place last week and was disclosed Monday. Google says it has changed its manufacturer review process to reduce the risk of similar firmware abuse.
