Dushanba kuni Google XCPE (aka X.CPE) — 1,3 milliondan ortiq Android televizor pristavkalaridan iborat orqa eshik va botnetni tarqatib yuborganini e'lon qildi.
Zararli dastur Videostrong Technology — Xitoyda joylashgan Android qurilmalari ishlab chiqaruvchisi va dizayn ishlab chiqaruvchisi (OEM/ODM) tomonidan ishlab chiqilgan va tarqatilgan. Ushbu kompaniya botnetni ham boshqargan.
Google ma'lumotiga ko'ra, Videostrong sheriklarga kirish huquqini sotgan va orqa eshik bilan jihozlangan qurilmalarga zararli modullarni yuklagan. Keyinchalik bu qurilmalar reklama firibgarligi va ma'lumotlarni o'g'irlash, turar-joy proksi-serverlari sifatida, shuningdek, qo'shimcha zararli dasturlarni yuklash uchun suiiste'mol qilingan.
"Biz ushbu zararli dasturiy ta'minotni ko'p yillar davomida turli qurilma modellari va brendlarida to'g'ridan-to'g'ri o'rnatilgan holda topdik. U maxsus infratuzilma bilan qo'llab-quvvatlangan va aniqlashdan qochish hamda sheriklarini boshqarish uchun doimiy ravishda o'zgarib boradigan konfiguratsiyalar bilan ishlagan", — deydi internet giganti.
Tarqatib yuborish doirasida Google botnet domenlari va serverlarini, shuningdek, XCPE botlariga yuklangan qo'shimcha modullar ortidagi buyruq va nazorat (C&C) domenlarini yo'q qilish uchun huquqiy choralar ko'rdi.
Bu, ehtimol, kamida 10 million boshqa qurilmaga kirishning uzilishiga olib kelgan, chunki modul operatorlari o'z zararli dasturlarini XCPE'dan tashqariga ham tarqatgan edi.
Google XCPE botneti Videostrong tomonidan ataylab amalga oshirilgan operatsiya bo'lgan, bu ichki xoinning ishi yoki ishlab chiqishdagi e'tiborsizlik natijasi emas, deb hisoblaydi. Shuning uchun kompaniya oldindan o'rnatilgan Google ilovalari bilan qurilmalar ishlab chiqarishdan taqiqlangan.
"Google Android ekotizimida izchil va xavfsiz foydalanuvchi tajribasini ta'minlash uchun OEM'lardan keng qamrovli moslik va xavfsizlik sinovlaridan o'tishni talab qiladi. Biroq Videostrong bizning sinovlarimizdagi bo'shliqdan foydalanish va qurilmaning birinchi yuklanishidan keyin zararli kodni yuklash uchun xiralash usullarini qo'llagan", — deydi Google.
Videostrongning oldindan o'rnatilgan zararli dasturi uch bosqichli arxitekturaga ega bo'lgan: /oem/ bo'limida saqlanib qolgan asosiy orqa eshik, yuklovchi va ijro etish dvigateli, hamda qo'shimcha orqa eshiklarni ishga tushirish va ko'proq modullarni yuklash imkoniyatiga ega monetizatsiya modullari.
Kompaniya sheriklarga o'z orqa eshigiga kirish huquqini taqdim etgan va shu orqali ular zararlangan qurilmalarni uzoq vaqt davomida monetizatsiya qilish imkoniyatiga ega bo'lgan.
"XCPE botnetidagi zararlangan qurilmalarning aksariyati Android TV televizor pristavkalari bo'lsa-da, biz boshqa Android asosidagi IoT qurilmalari, jumladan, telemeditsina qurilmalari, karaoke mashinalari va raqamli belgi qurilmalari ham zararlanganini kuzatdik", — deb ta'kidlaydi Google.
XCPE'ni to'xtatishda Google Yaponiyaning Milliy politsiya agentligi, Lumen, Human Security, Plume, Synthient va TrendAI'dan yordam olgan. Botnet va tarqatib yuborish haqida texnik tafsilotlar Plume (PDF), Synthient va TrendAI tomonidan ham e'lon qilingan.
"Bizning harakatlarimiz o'ndan ortiq zararli aktyorlarga jiddiy ta'sir ko'rsatganiga ishonamiz, ammo asosiy noqonuniy bozor chidamli. Orqa eshik operatorlari, reklama firibgarligi halqalari va turar-joy proksi provayderlari o'zaro bog'langan ta'minot zanjiri sifatida ishlaydi va bir komponent to'xtatilganda, operatorlar tezda yangi yuklovchilarga yoki raqib monetizatsiya SDK'lariga o'tadi", — dedi Google.
Bog'liq: Zararli Claude Code kengaytmasi Cursor ta'minot zanjiri hujumida tarqatildi
Bog'liq: O'q o'tmas xost Virtualine domenini FBI musodara qildi
Bog'liq: Microsoft 1 milliarddan ortiq xabar ortidagi xitoy tilidagi fishing bozorini to'xtatdi
Bog'liq: FBI Shimoliy Koreyaning Binance o'g'irligiga bog'liq 600 dan ortiq manzilni belgiladi
Google on Monday announced the dismantling of XCPE (aka X.CPE), a backdoor and botnet of more than 1.3 million Android set-top boxes.
The malware was developed and deployed by Videostrong Technology, a China-based original equipment manufacturer and original design manufacturer (OEM/ODM) of Android devices that also operated the botnet.
Videostrong, Google says, sold access to affiliates and loaded malicious modules on the backdoored devices, which were then abused for ad fraud and data exfiltration, as residential proxies, and for loading additional malware.
“We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates,” the internet giant says.
As part of the takedown, Google took legal action to take down the botnet’s domains and servers, as well as the command-and-control (C&C) domains behind the additional modules loaded on the XCPE bots.
This likely resulted in severed access to at least 10 million other devices, as the module’s operators had diversified the distribution of their malware beyond XCPE.
Google believes the XCPE botnet was a deliberate operation by Videostrong, not the work of a rogue insider or the result of a development oversight. As such, it banned the company from making devices with preloaded Google apps.
“Google requires OEMs to go through a comprehensive suite of compatibility and security tests to ensure a consistent and safe user experience across the Android ecosystem. However, Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot,” Google says.
Videostrong’s pre-installed malware has had a three-stage architecture consisting of the primary backdoor that persisted on the /oem/ partition, a loader and execution engine, and the monetization modules that could execute additional backdoors and load more modules.
The company provided affiliates with access to its backdoor, thus allowing them to monetize the infected devices for a long time.
“While the overwhelming majority of the infected devices in the XCPE botnet are Android TV set-top boxes, we observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices,” Google notes.
In XCPE’s disruption, Google received help from Japan’s National Police Agency, Lumen, Human Security, Plume, Synthient, and TrendAI. Technical details on the botnet and the takedown were published by Plume (PDF), Synthient, and TrendAI as well.
“While we believe our actions have seriously impacted over a dozen malicious actors, the underlying illicit market is resilient. Backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain, and when one component is disrupted, operators quickly pivot to new loaders or rival monetization SDKs,” Google said.
Related:Malicious Claude Code Extension Served in Cursor Supply Chain Attack
Related:Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
Related:Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Related:FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
