I think any organisation that lets a connected device onto its network should watch that device after first boot before it trusts it, because Google’s account of the XCPE botnet says the certification checks ran before the malicious code arrived.
On 2 November Google Threat Intelligence Group published its account of the XCPE takedown. Google and partners dismantled a backdoor that enrolled more than 1.3 million set-top boxes into a botnet. Google says it assesses with high confidence that the backdoor was developed, deployed and operated for financial gain by Videostrong Technology Co., an Android device maker. That is Google’s finding, and Videostrong’s own response is not in the sources I read.
The test ran at the wrong moment
The detail that matters to buyers is the timing. Google writes that Android device makers must pass a suite of compatibility and security tests, and that “Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot.” Google says it has changed its review process as a result.
A buyer who relies on that certification has relied on a check that, in this case, finished before the harmful part of the firmware activated. The backdoor was preloaded in the firmware partition, and Google says that if a user uninstalls it, it reinstalls itself from the /oem/ partition on reboot. TrendAI’s research says owners cannot remove the implant themselves, because it runs as a system app signed with the manufacturer’s key, so cleanup needs “vendor action, platform protection or replacement of the device.”
The reach was wider than living-room televisions. Google observed infected telehealth devices, karaoke machines and digital signage alongside the set-top boxes, and TrendAI’s telemetry counted 1,472,554 infected devices across 206 models in more than 170 countries. Charley Snyder, Head of Disruption Operations at Google Threat Intelligence Group, said of the operation: “Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach.”
The strongest objection
The best argument against my position is that enterprises rarely buy white-label television boxes, so this is a consumer problem and the security team has bigger priorities. I accept that a corporate network is not the first place most of these devices landed. TrendAI answers the rest of it: organisations with remote staff should treat unmanaged consumer devices on home networks as part of their exposure and keep corporate access behind managed endpoints. Digital signage and telehealth hardware are bought by organisations, and Google found both infected.
The same weakness has turned up before on this site. A CERT-FR warning about compromised refrigeration controllers and Black Lotus Labs’ account of Volt Typhoon’s relay framework both describe ordinary devices that someone else was using as infrastructure.
Google also cautions that backdoor operators, ad-fraud rings and residential proxy providers operate as an interconnected supply chain, and that point-in-time disruptions do not end the work. A buyer who treats the takedown as the end of the story is waiting for someone else to finish a job that also sits on the buyer’s own network.
What I would put in the buying process
Treat a new connected device as untrusted until it has run for a few days on a segment of its own. Record where it connects. Google describes the XCPE devices fetching configuration over HTTP and then holding a persistent MQTT connection to receive instructions, which is the kind of long-lived outbound session a baseline would show. A television box that talks to a message broker nobody can explain has failed the test.
Ask the vendor who signs the firmware, how updates arrive and who can push code to the device after sale. Put the answers in the contract. Where a device cannot be inspected, keep it off networks that carry sensitive systems. Where one is found infected, plan to replace it, since the reinstall behaviour Google describes survives a reboot.
Google says it has made changes to its review process, and a procurement team does not have to wait to see whether they close the gap. A few days of watching a device after first boot costs almost nothing.
Source: Google Threat Intelligence Group, Shutting the Door on the XCPE Botnet
