{"id":110088,"date":"2026-11-03T12:08:21","date_gmt":"2026-11-03T17:08:21","guid":{"rendered":"http:\/\/pappp.net\/?guid=3f4cf1c16fe5dfc69f237902d86108c0"},"modified":"2026-11-03T12:08:21","modified_gmt":"2026-11-03T17:08:21","slug":"google-dismantles-botnet-secretly-running-on-1-3-million-android-tv-boxes","status":"publish","type":"post","link":"https:\/\/pappp.net\/?p=110088","title":{"rendered":"Google dismantles botnet secretly running on 1.3 million Android TV boxes"},"content":{"rendered":"

Source: Ars Technica<\/a><\/p>\n

Article note: Bundled crapware that intentionally turned into a botnet, instead of the usual route via incompetence. \nI bet half the IoT vendors are contemplating whether they would more profitable as a botent operator than their advertised business, in the same way that a bunch of TV vendors have determined that there is more money to be made in surveillance\/advertising than selling TVs.<\/div>

Google's Threat Intelligence Group says it has shut down a massive botnet called x.cpe. At its height, x.cpe ran on more than 1.3 million Android TV devices, and unusually, these were Google-certified boxes. Google says its screening process missed the malware due to \"obfuscation techniques\" employed by Shenzhen-based Videostrong Technology.<\/p>\n

In a detailed blog post<\/a>, the Threat Intelligence Group explains how the x.cpe botnet evolved quickly from a single-stage dropper into a modular three-stage malware platform that sold access to third parties. Manufacturers must have their devices certified if they want access to Google apps and branding, a process that is supposed to catch threats like this. However, Videostrong's compromised boxes, mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online.<\/p>\n

After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator's behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious.<\/p>

Read full article<\/a><\/p>\n

Comments<\/a><\/p>","protected":false},"excerpt":{"rendered":"

Google’s Threat Intelligence Group says it has shut down a massive botn…<\/p>\n

Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[226],"tags":[],"class_list":["post-110088","post","type-post","status-publish","format-standard","hentry","category-news-2"],"_links":{"self":[{"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/posts\/110088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=110088"}],"version-history":[{"count":0,"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/posts\/110088\/revisions"}],"wp:attachment":[{"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=110088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=110088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=110088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}