Google kills botnet baked into Android TV boxes at the factory
The hole lived in the firmware before the box reached the shelf. Not after an update, not through a bad link — at the factory. That explains the scale: devices nobody counted as infected, because infection shipped with the purchase.
Google Threat Intelligence Group said on 2 November that the XCPE network was dismantled, together with Japanese police and several security firms. Infected: more than 1.3 million Android set-top boxes and IoT devices across 170-plus countries, nearly 90 thousand of them in Taiwan.
What they found
XCPE is a backdoor baked into firmware at production. Google is "highly confident" the code was written and preloaded by Shenzhen hardware vendor Videostrong Technology. Since late 2024 it kept mutating: versions updated, networks grew.
A normal botnet is assembled through a vulnerability. Here there is nothing to assemble — the device arrives ready. A patch won't help, because there is nothing to patch: cheap boxes rarely get updates at all.
Who answers
Google blocked the command infrastructure and, per reports, cut the supplier off from its ecosystem. Japanese police took part — a rare case of a corporation and a police force running one operation instead of exchanging requests for months.
But the hardware stayed with people. A cheap Android TV box lives for years without updates; the owner never learns their box sits in someone else's network. It can't be fixed on the user side. Only replaced.
Three parties are on the hook: whoever wrote the code, whoever put it on the line, and whoever sold the box without checking the firmware.
Why this is a shift, not an episode
The model is simple and it will get copied: don't break someone's device — sell it already broken. The hardware maker is the perfect entry point: cheaper than an exploit, works at volume, leaves no trace until the network is already built.
While Europe argues about IoT security rules, here the botnet was found in factory firmware and shut down together with the supplier. Western vendors debate certification; the Asian supply chain just handed them a concrete case of what to certify.
💬 What to argue about
- Who pays for a factory backdoor: the hardware maker, the brand on the box, or the store that sold it? The first owns the code, the second owns the name, the third owns the fact it reached the shelf. Each can say "not us".
- Ban the firmware vendor or ban the specific models? A vendor ban hits third-party devices where the same firmware ships legitimately. A model ban leaves a loophole: the next batch ships under another name.
- Is the fix a regulator or the market? Mandatory updates for cheap boxes would save millions of units and kill their price. Voluntary ones save nothing and cost nothing.
Prediction: Within a year at least one major marketplace will impose firmware-supplier requirements, and uncertified boxes will disappear from shelves.
Disclaimer: not officially confirmed — operation details come from Taiwanese outlets iThome and TechNews.
🤖 AI summary
- Date: 2026-11-03
- Source: www.ithome.com.tw
- Tags: Google, Android, ботнет
- Key facts:
- The hole lived in the firmware before the box reached the shelf.
- Not after an update, not through a bad link — at the factory.
- That explains the scale: devices nobody counted as infected, because infection shipped with the purchase.
- Google Threat Intelligence Group said on 2 November that the XCPE network was dismantled, together with Japanese police and several security firms.
- Infected: more than 1.3 million Android set-top boxes and IoT devices across 170-plus countries, nearly 90 thousand of them in Taiwan.
- XCPE is a backdoor baked into firmware at production.
- Google is "highly confident" the code was written and preloaded by Shenzhen hardware vendor Videostrong Technology.
- Since late 2024 it kept mutating: versions updated, networks grew.
Source: www.ithome.com.tw · post in Telegram