1.3 million set-top boxes in botnet; Google blocks manufacturer authentication

Google said it disrupted the command-and-control infrastructure of the XCPE botnet, which had ensnared more than 1.3 million Android set-top boxes, and severed ties with manufacturer Videostrong, barring the company and its affiliates from producing or selling certified Android devices or supplying software to other certified makers. In a threat analysis published on the 2nd, Google said it took legal action against XCPE's control domains and servers, though it noted the move does not remove the malicious firmware already installed on individual devices. Google assessed with high confidence that Videostrong developed, deployed, and operated the backdoor for financial gain, an assessment it stressed is distinct from any court ruling. The backdoor was embedded in devices before they were sold to consumers. The action matters because it targets the supply chain of certified Android hardware rather than a single malware campaign, and the key thing to watch is whether the infected devices can be remediated and whether further legal or enforcement steps follow against Videostrong.