Google shuts down hidden network inside 1.3 million Android TV boxes

Google has shut down a hidden network of about 1.3 million Android TV boxes that were secretly working for someone else. Most were sold under the MECOOL brand by a company called Videostrong. Google has cut ties with the company. The cleanup is not complete, though, so owners of these boxes should check whether theirs is on a list of affected models.

What the hidden software did

Security researchers call this kind of network a botnet: many infected devices controlled remotely. After a box was set up and online, a small app called x.cpe, or com.oemservice, contacted its operator. The app was harmless by itself, but it had deep system permissions to install other malware. It also switched off Play Protect, Google's built-in security scanner, so the silent installs went unflagged.

Google found most boxes were used as residential proxies, which route large volumes of bad traffic through a home connection, or for ad fraud. Videostrong also had full access. Operators could run commands, capture the screen and probe other devices on the same home network. Google reportedly saw Videostrong doing this in real time.

How it got past Google's checks

Makers must have devices certified to get Google apps and branding. That process is meant to catch threats like this. Videostrong's boxes got through because the malware was not on them at the time. A backdoor installed it after the devices were online.

What Google did

Google worked with Japan's National Police Agency, Synthient and Trend Micro. It says it took legal action to shut down the domains and servers Videostrong used, including servers tied to other malware campaigns. Google also ended its relationship with Videostrong. The company and any subsidiaries can no longer use Google's Android apps and services. Google says it is updating its certification process to close the loophole.

Who it affects

Trend Micro counted 1,472,554 infected devices, somewhat more than Google's estimate. Most were in Brazil, Malaysia, Iraq, Mexico and Taiwan. Tens of thousands were also online in the US, Germany, the UK, Australia and Canada.

What to do

Synthient has published a list of 182 device model names known to be part of the botnet. Anyone with a MECOOL box, or a no-name Android TV box of unknown origin, should compare their model against it.

The takedown should make affected boxes safe to use, but probably not as safe as they should be. Play Protect is still off, and the inactive malware modules remain installed as system apps, which users cannot easily remove.

What happens next

Android is open source, and many uncertified Android TV boxes exist. Videostrong could keep selling hardware under other brands, just without Google apps. It would still have to rebuild its malware operation from scratch.