Google suspended business dealings with device manufacturer Videostrong Technology after disrupting an ad-fraud network called XCPE that used remote device control. More than 1.3 million TV devices were reportedly infected with malware.
Google announced on 2 November that it had disrupted the operations of XCPE, a network that had exploited more than 1.3 million TV devices for ad fraud and other purposes. Google determined that device manufacturer Videostrong Technology had added and operated malware for financial gain, and suspended business dealings with the company. Japan’s National Police Agency also cooperated with the investigation.
XCPE used a backdoor to remotely control devices without users’ knowledge, leaving large numbers of devices in a state that enabled them to be used for criminal activity. Most infected devices were Android TV set-top boxes, with malware installed in devices across multiple brands and models.
Google’s analysis found evidence that the operators had captured device screens, transmitted keystrokes and exfiltrated account information. The malware had been preinstalled in the firmware and was designed to return when the device restarted, even after the app had been deleted.
As a countermeasure, Google took legal action against the domains and servers used to add command-and-control servers and malware, and prohibited Videostrong and its affiliates from manufacturing or selling certified Android TV devices or supplying software to other companies. Multiple organisations, including the National Police Agency, cooperated.