Google cuts criminals off from 1.3 million TV boxes with a built-in backdoor

Google announced on Monday 2 November that, together with partners, it has shut down a botnet of more than 1.3 million TV boxes. A botnet is a large number of devices that are controlled remotely without their owners knowing. The operation itself took place the week before. Google worked with the Japanese national police, the American network company Lumen and four security companies: HUMAN Security, TrendAI, Plume, which noticed the suspicious traffic from the boxes, and Synthient, which traced the backdoor back to its maker.

What is special is how the boxes ended up in the botnet. They were not hacked: the hidden software that allowed remote control, known as a backdoor, was already inside when they left the factory. Google says it is highly confident that the Chinese manufacturer Videostrong Technology from Shenzhen built this backdoor itself and earned money from it for years. Videostrong makes TV boxes under its own brand Mecool and for other brands. The evidence against the company included a GitHub account with Videostrong's name in it and a technical document signed by the company's research director. Google calls it an unacceptable breach of users' trust.

A manufacturer with Google's certification

Manufacturers that want to put Google's apps, such as the Play Store, on their devices must first have those devices tested by Google. If they pass, they receive Google's certification. Videostrong had that certification. According to Google, the company hid the backdoor in a way that slipped through a gap in the tests: the malicious code was only loaded after the device had been started for the second time. During the test, nothing suspicious could be seen.

Not all boxes in the botnet were certified. According to Plume, there were also boxes that run on the freely available basic version of Android, without Google's apps and without a test by Google. In an earlier large botnet in TV boxes, BadBox 2.0, Google says only such cheap, uncertified devices were involved. The fact that a certified manufacturer built the backdoor in itself makes this case different.

What the backdoor could do

The backdoor, called x.cpe, was allowed to do on the box everything that Android itself is allowed to do. This meant the operators could install apps without anyone noticing, switch off Android's built-in virus scanner, see what was on the screen through screenshots, press buttons remotely, run commands and measure the box's internet connection. Google saw that they really did collect data from user accounts and from the boxes themselves.

Owners could not get rid of the backdoor. It sits in the firmware, the basic software that the factory puts on the device. In addition, the box keeps a backup copy in a part of its memory that the user cannot reach. If someone removes the backdoor anyway, it comes back from that copy after a restart.

Access rented out to criminals

According to Google, Videostrong earned money from the boxes by selling access to criminal partners, who had their own software installed on them. Some of that software committed advertising fraud: the box clicks on adverts invisibly, so that advertisers pay for advertising that nobody has seen. Other software, including from the proxy companies Linkfog, NetNut and Traffmonetizer, rented out the owner's internet connection. Customers of such a service send their internet traffic through the box in someone's living room, so that it is impossible to see where that traffic really comes from.

The software of these criminal partners was not only on Videostrong's boxes. It also ran on other devices that had been infected in other ways. Because the coalition also took the servers of those partners offline, Google says the criminals can no longer control at least 10 million other devices.

What owners can do

Now that the servers are offline, the criminals can no longer control the boxes. The backdoor itself is still there. Google has banned Videostrong and any future subsidiaries: they may no longer make devices with Google's certification or supply software to manufacturers that do. Google has also adjusted its test and now checks the firmware of certified Android TV devices more closely.

Synthient advises owners to stop using such a box. Google advises buying devices such as TV boxes only from trustworthy manufacturers and checking the list of manufacturers with Google's certification first. Videostrong and its brand Mecool are not on it. Google also advises keeping Android's virus scanner switched on and being careful with apps that promise money for "sharing" your internet connection.

Gavin Reid, head of security at HUMAN Security, says that such botnets exist because there is money to be made from them. By going after the servers with which the criminals earn that money, it becomes more expensive and less attractive to set up a botnet, he says.

What does this mean for the road to the singularity?

More and more devices in our homes are connected to the internet: TV boxes, smart speakers, cameras and, before long, household robots. Such devices can only help us if we can trust that the manufacturer has not hidden anything in them. This case shows that a single test before sale is not enough for that, and Google is now adjusting its checks accordingly. It also shows that tech companies, security experts and police can work together to take a botnet of this size out of the hands of criminals. Every time this succeeds, the connected devices we rely on more and more become a little safer.

What is the technological singularity? Read the explanation →