- Google leads efforts to dismantle 1.3 million device residential proxy botnet built through malware preinstalled on Android hardware
- Researchers say manufacturer Videostrong intentionally shipped malware and sold botnet access to cybercriminals
- Google seized infrastructure, blocked the company from Android certification, and strengthened device security checks
Google has revealed its role in taking down a massive residential proxy network and the malware that built it - with the unusual twist that the developer was a seemingly legitimate business with multiple products and countless trusting customers.
In a blog post, the company said that together with its partners, it dismantled a backdoor called XCPE. This malware was apparently used for ad fraud, served as a dropper for additional malware, and used for assimilating devices into an illegal residential proxy network.
In total, more than 1.3 million set-top boxes alone were part of the network, the company said.
No supply chain attack
Malicious residential proxy networks are nothing new - they emerge and get dismantled on a regular basis. But this one was unique, as it came preloaded on Android devices built and sold by a certified Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). In other words, people were thinking they were buying a legitimate product from a legitimate, Google-vetted company, but were instead getting malware-laden hardware that abused their trust and sold their bandwidth to cybercriminals.
In this case, not only did the company know what it was doing, but it was actively developing the malware and even worked on hiding it from Google and everyone else.
“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users,” Google said, not hiding its disappointment with the manufacturer.
Videostrong ended up selling two things: On the surface, it was selling Android-powered smartphones and similar devices that contained malware that built a botnet. Under the table, it was selling access to that botnet to cybercriminals.
Google was joined by a number of other companies and agencies in this operation, including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.
Threat actors are always in need of residential proxy botnets. They can use them to launch powerful Distributed Denial of Service (DDoS) attacks, hide their addresses as they operate, conduct large-scale credential stuffing campaigns, bypass geographical restrictions, scrape websites at scale, and more. We don’t know how much Videostrong made from selling access to the botnet, or who used it.
Taking down the C2 domains
To disrupt both the malware and the network, Google took down the domains and servers the company used to control the botnet and install malware modules, took down C2 domains that were used by over a dozen malware families loaded as modules via the XCPE backdoor, and banned Videostrong and all future subsidiaries and affiliates from building and selling Android devices in the future, or supplying software to other certified vendors.
Google also said it had improved its firmware integrity checks for certified Android TV devices to prevent similar incidents involving other manufacturers.
“Google requires OEMs go through a comprehensive suite of compatibility and security tests to ensure a consistent and safe user experience across the Android ecosystem,” it stressed. “However, Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot. As a result, Google has implemented changes to its existing review process to better safeguard against similar activity in the future.”
This is not the first time an electronic device came with malware off the shelf. Last month, security researchers Bitdefender found Android phones from multiple manufacturers, including Doogee and Cubot (both Chinese firms) being sold with preloaded malware. However, in those cases, the supply chain was compromised and the malware was included without the OEM’s knowledge, or consent.
