1.3M Android TV boxes exposed as Google disrupts XCPE botnet

Google and partners disrupted XCPE, a botnet spanning over 1.3 million Android TV set-top boxes, the company said on November 2, cutting the criminals’ remote access but leaving malicious software embedded in device firmware. Google said the preinstalled agent, known as x.cpe or com.oemservice, had system-level access, reinstalled from the /oem/ partition after reboots and was digitally signed with the manufacturer’s key. Google blamed manufacturer Videostrong for deliberately building and operating the backdoor and banned it and future affiliates from certified Android devices, while strengthening firmware checks; Japan’s National Police Agency and security firms assisted. A November 3 review of public findings from Google, TrendAI and Synthient and MECOOL’s warranty page found no XCPE-specific recall, clean-firmware update or mass-replacement program.