A Local Solution to the Botnet Threat Affecting MECOOL and Other Android TV Boxes

A Local Solution to the Botnet Threat Affecting MECOOL and Other Android TV Boxes

XCPE Guard, a free security tool developed to combat the XCPE botnet affecting Android TV boxes, detects and disables malware on devices, particularly those manufactured under the MECOOL brand.

Following Google's discovery of the XCPE botnet affecting more than 1.3 million Android TV boxes, a new security tool has been developed to address a threat that also concerns users in Türkiye.

Developed by software engineer, the open-source tool XCPE Guard aims to detect and disable hidden backdoors embedded in devices' factory firmware.

According to Synthient's data, 32,532 devices in Türkiye were identified as part of this botnet, placing the country 11th worldwide in terms of affected devices.

However, the risk may not be limited to MECOOL devices. China-based Videostrong Technology is an OEM/ODM manufacturer that supplies hardware and software to other brands in addition to its own products.

Therefore, Android TV boxes manufactured within the company's supply chain and sold under different brands in Türkiye may also be at risk. According to some user reports, NEXT and Hiremco branded TV boxes may also have been affected.

How Were Android TV Boxes Turned into a Botnet?

According to Google's investigation, Videostrong Technology embedded a hidden backdoor called x.cpe into the factory firmware of certain devices across various brands and models.

Operating as a system application with elevated privileges, the malware activates when the device is first powered on and performs malicious activities without the user's knowledge.

Through this backdoor, attackers could remotely install applications, execute commands, capture screenshots, and collect user information.

Compromised devices were also used for advertising fraud and incorporated into residential proxy networks, allowing third parties to route their traffic through users' home internet connections.

Google attempted to cut off attackers' access to the compromised devices by shutting down the botnet's command-and-control servers.

However, the backdoor remains embedded in the devices' firmware and may be reinstalled when the device is restarted.

XCPE Guard Disables the Backdoor.

Developed by Öztürk, XCPE Guard uses the Android TV box's built-in debugging service to scan for malware and disable detected malicious components.

The application does not require a computer or root access and guides users step by step through the process of granting the necessary permissions.

Using threat indicators published by Google, the tool checks for malicious packages, including x.cpe, com.oemservice, and com.abc.nexus.

It also examines suspicious manufacturer applications, known malicious file fingerprints in system partitions, accessibility services, running processes, and network connections to botnet servers.

Detected malicious applications are disabled. XCPE Guard also removes the malware's accessibility service connection and re-enables Google Play Protect.

To install the application, users must first download the APK file from XCPE Guard's GitHub page.

The file can be installed on an Android TV box using an application such as Downloader or through ADB commands from a computer.

After installation, certain settings must be configured on the Android TV box.

Users must first enable Developer Options in Android settings, then activate ADB debugging and authorize the connection.

On devices running Android 11 or later, wireless debugging and pairing codes can be used. Some devices also support ADB connections over the network.

After the initial connection, the application obtains the necessary permissions and performs a security scan.During this process, it temporarily enables the debugging service and disables it again once the scan is complete.

The application can also perform daily automated scans to check whether previously disabled malicious packages have been reactivated. Although XCPE Guard disables the malware, it cannot remove backup copies embedded in the device's system files.

As a result, the malware may be reinstalled when the device is restarted. A permanent solution requires the manufacturer to release a clean firmware update. If such an update is unavailable, replacing the device may be necessary.

As an additional security measure, blocking malicious servers is recommended. To achieve this, malicious server addresses identified by Google can be added to network filtering tools such as AdGuard Home, preventing Android TV boxes from connecting to those servers.

Some of the Measures We Should Take to Protect Against Such Attacks Include:

• Regularly checking for firmware updates and security patches for Android TV devices.

• Choosing devices from trusted manufacturers and avoiding applications from unknown sources.

• Scanning devices for malware using trusted security tools such as XCPE Guard.

• Disabling ADB debugging and remote access features when they are not in use.

• Blocking access to malicious servers through DNS filtering and firewall rules.

• Isolating Android TV devices on a separate network, such as a VLAN or guest network, whenever possible.

• Removing devices from service or replacing them if malware cannot be permanently eliminated.

        For more information, please contact our security experts at info@zerosecond.ae.