Google dismantles botnet secretly running on 1.3 million Android TV boxes
Google’s Threat Intelligence Group says it has shut down a massive botnet called x.cpe. At its height, x.cpe ran on more than 1.3 million Android TV devices, and unusually, these were Google-certified boxes. Google says its screening process missed the malware due to “obfuscation techniques” employed by Shenzhen-based Videostrong Technology.
谷歌威胁情报小组表示，他们已经关闭了一个名为 x.cpe 的大型僵尸网络。在鼎盛时期，x.cpe 在超过 130 万台安卓电视设备上运行，且不同寻常的是，这些设备均为谷歌认证的电视盒。谷歌称，由于总部位于深圳的 Videostrong Technology 采用了“混淆技术”，其筛选过程未能发现该恶意软件。
In a detailed blog post, the Threat Intelligence Group explains how the x.cpe botnet evolved quickly from a single-stage dropper into a modular three-stage malware platform that sold access to third parties. Manufacturers must have their devices certified if they want access to Google apps and branding, a process that is supposed to catch threats like this.
在一篇详细的博客文章中，威胁情报小组解释了 x.cpe 僵尸网络如何迅速从一个单阶段下载器演变成一个模块化的三阶段恶意软件平台，并向第三方出售访问权限。制造商若想获得谷歌应用和品牌的使用权，必须对其设备进行认证，而这一流程本应能够拦截此类威胁。
However, Videostrong’s compromised boxes, mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online. After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator’s behest.
然而，Videostrong 受感染的电视盒（大多以 MECOOL 品牌销售）通过后门程序，在设备设置完成并联网后远程安装恶意软件，从而规避了检测。设备联网后，一个名为 x.cpe 或 com.oemservice 的存根应用程序会向服务器发送信号。该软件包本身不具备恶意功能，但拥有在运营商指令下安装恶意软件模块所需的系统级权限。
It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious. Google found most of the boxes were running residential proxies for routing large volumes of nefarious traffic or modules that engaged in ad fraud schemes. Selling access to this botnet was probably a big business.
它还禁用了 Play Protect，否则后者本会将这些静默安装的软件包标记为恶意软件。谷歌发现，大多数电视盒都在运行住宅代理，用于路由大量非法流量，或运行参与广告欺诈计划的模块。出售该僵尸网络的访问权限可能是一项巨大的业务。
Videostrong also had full access to the devices, allowing operators to run terminal commands, capture the screen, and probe other devices on the local network. Google reportedly observed Videostrong doing this in real time. Google worked with several other organizations to disrupt the x.cpe network, including Japan’s National Police Agency, Synthient, and Trend Micro.
Videostrong 还拥有对设备的完全访问权限，允许运营商运行终端命令、截取屏幕并探测局域网内的其他设备。据报道，谷歌曾实时观察到 Videostrong 的此类行为。谷歌与包括日本警察厅、Synthient 和趋势科技在内的多家机构合作，破坏了 x.cpe 网络。
Google says it has taken legal action to shut down the domains and servers Videostrong used to operate and install its malware. It also went after command-and-control servers operated by Videostrong that were connected to other malware campaigns. Google estimates Videostrong has been cut off from about 10 million compromised devices.
谷歌表示，已采取法律行动关闭了 Videostrong 用于运营和安装恶意软件的域名及服务器。此外，谷歌还针对 Videostrong 运营的、与其他恶意软件活动相关联的命令与控制服务器采取了行动。谷歌估计，Videostrong 已被切断了与约 1000 万台受感染设备的联系。
This action should make the affected devices safe to use, but probably not as safe as they should be. Play Protect is still disabled, and the inert malware modules are still installed. Since they are loaded as system apps, users cannot easily remove them. Synthient has published a list of 182 device model names known to be included in the botnet.
此举应能使受影响的设备恢复安全使用，但可能仍未达到应有的安全水平。Play Protect 依然处于禁用状态，且惰性恶意软件模块仍被安装在系统中。由于它们作为系统应用加载，用户无法轻易将其删除。Synthient 已发布了一份包含 182 个已知被纳入该僵尸网络的设备型号名称列表。
Anyone who has purchased a MECOOL or white label Android TV box of unknown origin should check it. Trend Micro counted a total of 1,472,554 infected devices, somewhat higher than Google’s estimate. The overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.
任何购买了 MECOOL 或来源不明的白牌安卓电视盒的用户都应进行检查。趋势科技统计的受感染设备总数为 1,472,554 台，略高于谷歌的估计。绝大多数受感染设备位于巴西、马来西亚、伊拉克、墨西哥和台湾，但在美国、德国、英国、澳大利亚和加拿大也有数万台设备在线。
Google determined the operation was not the work of a rogue actor, so it has ended its relationship with Videostrong. The company, as well as any subsidiaries, will not be permitted to use Google’s Android apps and services. Google also notes that it is updating its certification process to close the loophole that allowed Videostrong to operate its botnet on certified devices.
谷歌认定该行动并非个别不法分子的所作所为，因此已终止了与 Videostrong 的合作关系。该公司及其任何子公司将不得再使用谷歌的安卓应用和服务。谷歌还指出，正在更新其认证流程，以堵住允许 Videostrong 在认证设备上运营僵尸网络的漏洞。
Android is open source, though, and there are countless uncertified Android-based TV boxes out there. Videostrong could continue to sell malicious hardware under other brands without Google apps. But it would still have to rebuild its malware operation from scratch.
不过，安卓系统是开源的，市面上还有无数未经认证的安卓电视盒。Videostrong 可能会在没有谷歌应用的情况下，以其他品牌继续销售恶意硬件。但它仍需从零开始重建其恶意软件运营体系。