Your TV box could be working for hackers: Google busts 1.3 million-device botnet
Imagine watching your favourite Netflix series on your Android TV box, completely unaware that the same device is secretly working for cybercriminals. Google has uncovered exactly this kind of operation, disrupting a massive botnet involving more than 1.3 million internet-connected devices. The company has accused Chinese manufacturer VideoStrong Technology of deliberately installing malicious software into TV boxes and selling access to hackers.
According to the Google Threat Intelligence Group’s November 2 report, the malware, called XCPE, was found inside devices sold under several brands over multiple years. Google has now banned VideoStrong from producing certified Android devices or supplying software to other certified manufacturers. The investigation involved Japan’s National Police Agency and cybersecurity firms including Lumen, HUMAN Security, Synthient and TrendAI.
:
What exactly did Google discover?
The malware was built into the devices themselves, allowing hackers to control them remotely. It could quietly install apps, capture screenshots, steal information and route internet traffic through the owner’s home connection.
Google , “We believe this campaign wasn’t an isolated rogue insider or a development oversight.”
Researchers at helped trace the operation to VideoStrong after examining an infected MECOOL TV box. They found company-related documents and links between VideoStrong’s infrastructure and servers controlling the malware.
:
Why are smart TVs and TV boxes perfect targets?
Smart TVs and streaming boxes are among the most common internet-connected devices in homes after smartphones. Many remain switched on or connected to Wi-Fi for hours, receive irregular security updates and rarely attract the same security attention as phones.
For hackers, that is an attractive combination.
| What hackers do | What it means for users |
|---|---|
| Fake advertisement views | Criminals earn money from fraudulent ads |
| Route internet traffic | Someone else’s activity appears to come from your connection |
| Steal device information | Personal data and account details may be exposed |
| Install more malware | Hackers can expand their control |
:
Google cuts off access to millions of devices
Google took legal action to shut down the servers controlling XCPE and several related malware operations. The company estimates that disrupting these systems could cut criminals’ access to at least 10 million additional compromised devices.
The problem is that the malicious code can remain inside affected devices even after their command servers disappear.
:
Is your Android TV at risk?
Google has not published a complete consumer-facing list of affected models. Owners of suspicious or uncertified Android TV boxes should check manufacturer details, look for trusted firmware updates and avoid installing apps from unknown sources.
If a device is confirmed infected, disconnecting it from the internet is the safest immediate step. A factory reset may fail to remove malware embedded in the system software.
The bigger concern is that a television box sitting quietly beside your TV could be doing much more than streaming movies.