Google dismantles botnet secretly running on 1.3 million Android TV boxes
谷歌搗毀秘密運行在130萬台安卓電視盒子上的僵屍網絡
Google has cut ties with the company behind the botnet campaign.
谷歌稱已關閉名為 x.cpe 的僵屍網絡，其高峰期感染超過130萬台經谷歌認證的安卓電視設備。惡意軟件由深圳廠商 Videostrong 通過後門在設備聯網後遠程植入，繞過了認證篩查。
文章按時間線講清一條攻擊鏈：認證篩查為何失效、後門如何等設備聯網再動手、stub 應用如何借系統權限裝模塊並關掉 Play Protect。讀時可練因果鏈梳理與同義替換（如 evaded detection / missed the malware），並注意“認證—後門—權限”三層前提如何層層遞進。適合練細節定位與技術類長句拆解。
Google's Threat Intelligence Group says it has shut down a massive botnet called x.cpe. At its height, x.cpe ran on more than 1.3 million Android TV devices, and unusually, these were Google-certified boxes. Google says its screening process missed the malware due to "obfuscation techniques" employed by Shenzhen-based Videostrong Technology.
In a detailed blog post, the Threat Intelligence Group explains how the x.cpe botnet evolved quickly from a single-stage dropper into a modular three-stage malware platform that sold access to third parties. Manufacturers must have their devices certified if they want access to Google apps and branding, a process that is supposed to catch threats like this. However, Videostrong's compromised boxes, mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online.
After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator's behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious.
重點詞彙
(8)
來源：Ars Technica · arstechnica.com