Explained: How a backdoor in Android TV devices exposed 1.3 million users

Google's discovery of a backdoor in more than 1.3 million devices, including Android TV-certified set-top boxes, has raised questions about the security checks used to certify connected consumer devices.

The malware, allegedly developed and embedded by Chinese device manufacturer Videostrong Technology, allowed attackers to access infected devices, steal information and use their internet connections without the owners' knowledge.

The incident is significant because some of the affected devices carried Google's Android certification, which is meant to indicate that they meet the company's compatibility and security requirements.

Google has acknowledged that Videostrong exploited a gap in its testing process to install malicious code after a device's first boot.

The company has since cut ties with the manufacturer and taken steps to disrupt the botnet.

The case raises a wider concern for consumers who buy Android TV boxes and other connected devices.

Even when a device carries a recognised software certification, its firmware and the manufacturer's practices can introduce security risks that are difficult for users to identify.What happenedAccording to Google Threat Intelligence Group, the backdoor, identified as XCPE or x.cpe, was built into multiple device models and brands manufactured by Videostrong over several years.

Google said it had high confidence that the manufacturer deliberately developed and operated the backdoor to generate revenue by selling access to infected devices to criminal affiliates.

A botnet is a network of internet-connected devices that have been infected with malicious software and can be controlled remotely by an operator.

The devices can include computers, smartphones, routers and smart home products.

Once infected, they can carry out instructions without the owner's knowledge.ALSO READ: When AI chatbots become advisors, who is responsible when things go wrong?In this case, more than 1.3 million set-top boxes were enrolled into the XCPE botnet.

According to Google Threat Intelligence Group, Videostrong monetised access to infected devices by allowing criminal affiliates to install additional malware modules for activities such as advertising fraud and residential proxy services.

The operation was not limited to Android TV boxes.

Google's investigation also identified the backdoor on telehealth devices, karaoke machines, and digital signage products.

Google said it worked with Japan's National Police Agency and cybersecurity companies, including Lumen, HUMAN Security, Plume, Synthient and TrendAI, to disrupt the operation.

The company took legal action to shut down the domains and servers used to control the infected devices and distribute malware.

It also took down the command-and-control domains used by more than a dozen malware families distributed through the backdoor.

Google estimates that this action could cut off access to at least 10 million additional compromised devices, although these devices were not necessarily all infected through XCPE.What could the malware do on an infected deviceThe XCPE backdoor gave its operators access to the device at the system level.

In simple terms, this meant the malicious software had privileges that allowed it to perform actions beyond what an ordinary application could do.

A regular application generally operates within a set of permissions and restrictions.

A system-level process has much broader access to the operating system and its functions.

This allowed the operators to install applications without the owner's knowledge, execute commands remotely, capture screenshots and collect information stored on the device.

Google's investigation found evidence of operators capturing live screenshots, injecting keystrokes and extracting account information, device details, installed application lists and system logs.ALSO READ: Asus launches Nvidia RTX Spark-powered ProArt series laptops: Hands-onThe malware could also disable Google Play Protect, Android's built-in security feature that checks applications for potentially harmful behaviour.

This made it easier to install additional malicious software without triggering the usual checks.

Another feature that made the backdoor difficult to remove was its presence in the device's firmware.

Firmware is the software built into a device that controls its basic hardware functions and helps the operating system communicate with its components.

Unlike an application that can be uninstalled through the settings menu, firmware is part of the device's underlying software.

Google found that XCPE could reinstall itself after a device restarted, even if a user had removed its visible application package.

This meant that conventional methods of removing unwanted applications were not enough to eliminate the infection.How were infected devices used for advertising fraud and proxy networksOne of the main ways the operators monetised the infected devices was by turning them into residential proxy nodes.

A residential proxy is an internet connection that routes another person's online traffic through a regular household internet connection.

Websites and online services see the traffic as coming from the household's internet address rather than the actual person or organisation....