Google certified the boxes, the manufacturer installed a backdoor, and 1.3 million customers got an involuntary side hustle as residential proxies. Now the botnet is disconnected, but the malware remains and Play Protect is still disabled. Apparently »certified« just means the box passed inspection before it started spying.

Videostrong’s compromised boxes, mostly sold under the MECOOL brand

Fucking clown show

Google dismantles botnet

But then, no updates are applied to affected devices, and

Google worked with several other organizations to disrupt the x.cpe network, including Japan’s National Police Agency, Synthient, and Trend Micro. Google says it has taken legal action to shut down the domains and servers Videostrong

Sounds more like Google asked these other people to dismantle a botnet after detecting it.

The headline implies they somehow stopped it through Google Play

Of course LTT was hawking this stuff for a buck.

I've been looking for a box to replace my Chromecast for a while now but was hesitant for precisely this reason. At some point I even looked at the MECOOL boxes. Good my paranoia prevailed. Still looking for an TV box though. Any suggestions?

Original article with full write up: https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/

com.oemservice

com.android.carrierconfig is that you?

Someone I know has one of these.

KD1:/ $ pm list packages | grep cpe
package:x.cpe
KD1:/ $ settings get global package_verifier_user_consent
1

Hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm, so Play Protect is enabled and doing nothing about it. Also, "nexus" wasn't installed, not here at least. Not "system.ntp", "oemservice" or "sso" either. com.droidlogic.* is just generic AmLogic crap, if there's a backdoor in there it's probably a different company. The Google article mentions libexploit.so, which doesn't exist with a quick find. Neither does libjaguar.so. libbase.so is just a generic file present everywhere, nothing interesting in strings for it. My guess is that it's geographically locked.

So I am not sure what I am supposed to do with that. I just ran pm disable-user on it, hopefully that's enough.

google doesnt like others cutting in thier own business.