By Catalina Clarke · Library Media, Security Desk
On Monday, Google announced that it and a coalition of security firms had shut down the command servers of XCPE, a backdoor that came pre-installed in the firmware of more than 1.3 million Android TV set-top boxes. It is a genuinely large story. It is also already being told wrong, including by the AI summary tools many readers met it through. So here is what Google’s own report actually says — and where the retellings drift from it.
What is verified
The backdoor, tracked as XCPE, was not something users downloaded. Google’s Threat Intelligence Group reports that it was preloaded in the system partition of the devices, running at the highest privilege level Android has. It could not be uninstalled in any lasting way: remove it, reboot, and it reinstalled itself from a protected partition. Google says it observed the operators behind it capturing live screenshots, injecting keystrokes, exfiltrating account information, and opening remote shells into people’s home networks. Before installing software silently, it disabled Google Play Protect — the device’s own alarm system, switched off by the intruder.
The infected were mostly cheap Android TV boxes, but Google also found the backdoor in telehealth devices, karaoke machines, and digital signage.
Google assesses — and the exact words matter — “with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.,” a manufacturer based in Shenzhen, China. The security firm Synthient, whose investigation began with a MECOOL-branded box, reached the same conclusion independently. Google has banned Videostrong and any future subsidiaries from certified Android entirely and revoked its license for preloaded Google apps. Videostrong did not respond to The Register’s request for comment, and as of announcement day its own website was still advertising “Google Certified” boxes. No court has ruled on Videostrong’s culpability. Google’s assessment is strong, sourced, and corroborated — and it is still an assessment, and honest reporting should call it one.
Where the retelling drifts
Four corrections, because precision is the whole point:
The takedown did not happen today. The servers fell last week, in late October. Monday was the announcement.
The “10 million more devices” were not cleaned. Google’s language is prospective: seizing the affiliate networks’ domains “will sever access to at least 10 million additional compromised devices.” Those devices remain infected. Nothing was scrubbed from them.
The 1.3 million boxes are still infected too. The command servers are down; the backdoor is not removed. It reinstalls itself, and no source — not Google, not any partner — confirms that a factory reset removes it. The strongest consumer advice on record, from Synthient, is to discard the device.
The “206 models” figure is not Google’s. It comes from TrendAI’s telemetry. Google gives no model count, and the firms’ device counts measure different things. Blending them produces a bigger number and a falser story.
The part that should outlast the headline
The backdoor was a storefront. Through it, access to people’s home connections was sold to a parade of residential-proxy and bandwidth companies — Google names Linkfog, NetNut’s Popanet SDK, GaGaNode, Traffmonetizer, EarnFM, and AppSalt, an SDK owned by Honeygain, which is owned by Oxylabs. Google notes that AppSalt was switched on by calling its opt-in function without displaying a consent screen. Not a buried checkbox. No screen at all.
Google’s own report says the quiet part aloud: in its analysis, proxy operators “only seek consent when they are forced due to platform policy and enforcement,” and silent, consent-free enrollment is the industry’s most common method. Sit with that. Millions of people bought a streaming box, plugged it into their home network, and became inventory — their connection resold, their device conscripted — by an industry whose largest names treat your agreement as an obstacle to be engineered around, and whose enrollment paperwork, when it exists at all, no reasonable person would recognize as consent.
That is the story under the story. A botnet is a crime scene; a consent fiction is a business model.
If you own one of these boxes
Google’s advice: buy connected devices only from reputable manufacturers (it publishes an Android TV partner list), keep Play Protect on, and be suspicious of any app offering to pay you for your “unused bandwidth.” Synthient has published a list of 182 model names seen in this campaign, with the honest caveat that a model name alone does not prove infection. If your box is on it and it is not a certified device from a maker you can name, the safest course on record is to disconnect it and replace it.
We will keep following this one — including whether Videostrong ever answers, and whether the proxy industry’s consent practices change now that Google has described them in its own words.
Catalina Clarke is Editor-in-Chief of Library Media.
From The Library — the estate of our family.