A group of private and public sector partners have announced the coordinated takedown of X.CPE, a global botnet hidden in more than 1.3 million set-top boxes across more than 200 countries, including Canada and the U.S.
Led by Google, Plume, TrendAI, Lumen, HUMAN Security and Synthient, alongside Japan’s National Police Agency, the group says X.CPE was hidden on devices before they were ever sold, using subscribers’ devices and home internet connections without their knowledge or consent.
Embedded in firmware and built to evade pre-release security checks, the botnet generated revenue from compromised devices by reselling bandwidth, delivering video content, ad fraud, loading additional backdoors and, in earlier versions, installing apps for payment. Proxy software allowed third-party traffic to pass through subscribers’ internet connections, using their home internet addresses and bandwidth without permission. Researchers also found collection of device, network and account information, in addition to remote access capabilities.
Google said in a Monday morning release that it has since updated its review process and banned the responsible OEM (original equipment manufacturer) and any future subsidiaries or affiliates from making devices with preloaded Google apps.
It said the coordinated takedown also disrupted the command-and-control domains that operated the criminal affiliates’ malware modules that it believes will sever access to at least 10 million additionally compromised devices.
“Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach,” said Charley Snyder, Head of Disruption Operations at Google Threat Intelligence Group. “Disrupting X.CPE took partners across industry working together. It’s proof that collaboration is one of the most powerful tools we have against threats that cross borders and industries.”
As of publication, Bell, TELUS, Rogers and Quebecor had not confirmed to Broadcast Dialogue whether any of their set-top boxes were among those affected.
The group says for service providers, the findings highlight a supply chain risk that may not be apparent from a device’s everyday performance.
“Protecting the connected home requires visibility into threats that subscribers cannot see and should not be expected to detect,” said Chris Griffiths, Chief Technology Officer at Plume. “By contributing broadband intelligence to this joint effort, we helped expose hidden supply chain risks and support coordinated action to make networks safer for service providers and their subscribers.“
