XCPE botnet on 1.3m Android TV boxes: what to do

According to an official analysis by the Google Threat Intelligence Group (GTIG), the XCPE botnet affected more than 1.3 million Android-based set-top boxes and other network devices. The organisation reported that OEM and ODM manufacturer Videostrong deliberately built a backdoor into the devices’ firmware for financial gain.

The case is a particularly important warning for people who use cheap TV boxes from little-known brands. Such a device may appear to do nothing more than stream online videos, yet it can remain connected to the home network at all times. A system compromised at the factory can therefore turn a household’s internet connection into a tool for abuse.

This was not a simple app infection

A botnet is a network of remotely controlled devices whose members can perform various tasks without their owners’ knowledge. An infected TV box may appear to work normally: it can launch apps and play content without displaying any obvious warning.

XCPE poses an especially serious risk because, according to GTIG’s analysis, the backdoor did not reach the devices later through a careless download or suspicious app. The code was built into the firmware, meaning it could have been present before the device reached the buyer. This is a supply chain security problem: users can take home a system that is already compromised.

According to a report by Infosecurity Magazine, the investigation ruled out an error by a developer acting independently or code that had been left in accidentally. The publication reported that the operation was conducted with the knowledge of the manufacturer’s management.

What could the infected devices be used for?

According to a report by Krebs on Security, the manufacturer sold remote access to criminal groups. The publication said these actors could install additional modules on the devices for purposes including ad fraud, data theft and the operation of residential proxy networks.

A residential proxy routes third-party internet traffic through the infected household’s connection. External services then see the public IP address used by the TV box rather than the true originator of the activity. This can help conceal the source of abuse while the owner of the connection remains unaware for a long time.

The case also highlights why a low-power device that mostly operates unnoticed can be an attractive target. A box placed behind a television is usually connected to the router continuously, and users check it less often than their phone or computer.

Why might a factory reset not solve the problem?

For an everyday Android problem, removing an unknown app or restoring the device to its factory settings is an obvious step. According to a technical report by Help Net Security, however, XCPE operated with system-level privileges and could reinstall itself from the protected system partition after a restart.

A factory reset generally deletes user data and settings, but does not necessarily replace the device’s underlying firmware. If the malicious component is already part of that firmware, it can become active again after the reset. Deleting apps or resetting the device therefore cannot be regarded as a reliable way to remove the infection.

In theory, authentic, clean firmware and a trusted recovery procedure could provide a solution. With a device of unknown origin, however, it is inadvisable to experiment with system images obtained from forums or file-sharing sites, as they may be faulty, intended for a different model or modified themselves.

What signs warrant extra caution?

It is not possible to determine reliably from the casing or menus whether a TV box is infected. The retail brand may not reveal the actual manufacturer either, as products made by a contract manufacturer can be sold under several different names.

The following circumstances do not prove an infection on their own, but may justify closer scrutiny of the device’s origin and network activity:

• the manufacturer, exact model or official support page is difficult to identify;
• regular security updates are not provided, and it is unclear how long the model will be supported;
• Google TV or Android TV certification cannot be clearly verified;
• unusual apps appear on the device, or it establishes unknown network connections even when it appears to be switched off;
• the product’s main attractions are an exceptionally low price or pre-installed services of questionable origin.

These signs may indicate that the product’s origin, update support and certification are insufficiently transparent. An unknown name in the network device list does not necessarily indicate an attack, as routers do not always identify connected devices accurately.

What can users do at home?

If a TV box of unknown origin becomes suspicious, its internet connection can be disabled as a precaution and it can be disconnected from the home network. This does not clean the device, but it may restrict its remote communications.

• Do not enter sensitive data on the device. It is inadvisable to use a primary Google account, enter banking details or provide a password used elsewhere on a suspicious device.
• Change passwords on another trusted device. This may be appropriate if the TV box was previously used to sign in to a sensitive account. Where available, multi-factor authentication can be enabled and active sessions reviewed.
• Check the router’s device list. This can help identify the TV box and unknown network clients, but cannot by itself rule out or confirm an infection.
• Separate smart devices from the rest of the network. If the router supports a guest network or a separate IoT network, these devices can be isolated from computers, phones and network storage.
• Consider replacing the device. If there is no reliable manufacturer support, authentic firmware or documented recovery procedure, continued use may present an unjustified risk.

Home network settings vary between routers, so it is advisable to follow the relevant manufacturer’s documentation when making changes. Disconnecting the device and changing passwords are precautionary steps, not proof that the device was actually affected.

The origin of the software also matters when buying

When choosing a TV box, it is worth examining the software behind it as well as the processor, memory and supported video resolution. Positive signs may include a clearly identifiable manufacturer, official product support, a documented update policy and verifiable certification.

The Android label alone does not necessarily indicate an officially certified Android TV or Google TV system. A cheap device may use a modified version of Android or one intended for another type of device. Before buying, it is therefore worth checking the exact model number, the manufacturer’s support page, the availability of updates and whether claims about certification can actually be verified.

An exceptionally low price does not by itself prove malicious behaviour. However, the cost of long-term support, security updates and verified software is not always visible in a specifications table. A product with little transparency can therefore represent not only a compromise in convenience but also a lasting network risk.

The key lesson

The XCPE case shows that the small box hidden behind a television should be treated as a fully fledged networked computer. If its manufacturer, software, certification and update support cannot be verified, sensitive accounts should not be used on it, and it may be appropriate to isolate it from more important devices on the home network.

A factory reset cannot be regarded as a reliable solution to a backdoor built into firmware. For a TV box of unknown origin or one behaving suspiciously, the more cautious course may be to disconnect it from the network, secure affected accounts and, if no trusted recovery option is available, replace the device.