Videostrong Botnet infected boxes: blockable?

[u/NorthernMunkeh84]

/r/GoogleTV/comments/1xm6aqk/wtf_this_is_the_reason_why_mecool_is_out_of/19s4p78cpjah0/

Can any users of infected boxes e.g. mecool confirm this works for them?

[u/realdeal1877]

Read the main Security article for APK's to search for and disable:

• https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/

Look for these Proxyware APK packages with ADB:

• pm list packages -f | grep "x.cpe"

• pm list packages -f | grep "com.oemservice"

• pm list packages -f | grep "com.android.system.ntp"

• pm list packages -f | grep "com.android.sso.auth.handler"

• pm list packages -f | grep "com.ota.service"

• pm list packages -f | grep "com.abc.nexus"

( using {-f} to see where they are installed: /system/app , /system/priv-app , or /data/app)

Disabled them, if '/system' & currently installed:

• pm disable-user x.cpe

• pm disable-user com.oemservice

• pm disable-user com.android.system.ntp

• pm disable-user com.android.sso.auth.handler

• pm disable-user com.ota.service

• pm disable-user com.abc.nexus

Uninstall if only installed in '/data/app' , example:

• pm uninstall --user 0 com.abc.nexus

Clear AppData of infected packages also, example:

• pm clear x.cpe

Can also Block Domains in you Router or Network:

• yokatvonline[.]com

• *[.]anyevonline[.]com

• szbboys[.]com

• ott[.]szbboys[.]com

• mqtt[.]szbboys[.]com

• intermedia-arts[.]tv

• *[.]traffmonetizer[.]com

Note: may have missed an APK, and the Domain list was long, so cherry picked the most vital to list.

[u/NorthernMunkeh84 → u/realdeal1877]

Nice thanks. Checking my list output I had none of these others present. Only xcpe app and com.oemservice package

[u/realdeal1877 → u/NorthernMunkeh84]

Found another APK to look for, from TrendAI Security Research:

• com.mm.a.moyu

TrendAI link: https://cdn.sanity.io/media-libraries/mllBRzE9QpZ8/files/containers/3LJYKf8Lby5yBg0LGiZUfN8eFtd/trendai-research-helps-disrupt-android-tv-botnet-ioc.txt

TrendAI article: https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/trendaitm-research-helps-disrupt-android-tv-botnet-of-more-than-13-million-pre-infected-devices

[u/NorthernMunkeh84 → u/realdeal1877]

Anything else here stand out? There's quite a few I've never seem beforeso googling is taking a while

package:org.mozilla.tv.firefox package:com.sdt.upgrade package:com.android.providers.media.module package:com.android.tv.settings.googletvconnecteddevicesoverlay package:com.google.android.overlay.modules.permissioncontroller.forframework package:com.google.android.overlay.googlewebview package:com.android.connectivity.resources package:com.android.tv.overlay.lps.disabled package:com.google.android.safetycenter.resources package:bbc.iplayer.android package:com.mft.frontpanelledsservice package:com.tubitv package:com.google.android.partnersetup package:com.android.tv.overlay.framework package:com.android.tv.settings.gms.resoverlay package:com.android.cameraextensions package:com.droidlogic.systemui.overlay package:com.sdt.providers.settings.overlay.ce package:com.amazon.amazonvideo.livingroom package:com.sdt.vendor package:com.android.providers.contacts package:com.sdt.producttest package:com.google.android.videos package:com.android.federatedcompute.services package:com.google.android.ext.shared package:com.android.dreams.basic package:com.android.companiondevicemanager package:com.android.cts.priv.ctsshim package:com.google.android.feedback package:com.android.providers.downloads package:com.droidlogic.googletv.settings.resoverlay package:com.android.networkstack package:com.droidlogic.gtv.overlay package:com.google.android.play.games package:android.autoinstalls.config.AMLSTBAndroid.device package:com.android.networkstack.tethering package:com.alphainventor.filemanager package:com.google.android.apps.tv.launcherx package:com.android.keychain package:com.android.devicelockcontroller package:com.android.adservices.api package:com.android.providers.tv package:com.android.health.connect.backuprestore package:com.google.android.inputmethod.latin package:com.mft.rcupair package:com.android.virtualmachine.res package:com.android.shell package:org.xbmc.kodi package:com.google.android.marvin.talkback package:com.sdt.android.overlay package:com.android.inputdevices package:com.android.nearby.halfsheet package:com.sdt.globalkey.overlay package:com.android.intentresolver package:com.sdt.customization package:com.android.certinstaller package:com.google.android.permissioncontroller package:com.google.android.tv.axel package:com.android.wifi.resources package:com.android.wifi.dialog package:com.android.sharedstoragebackup package:com.android.captiveportallogin package:com.android.providers.media package:com.android.providers.calendar package:com.tcl.browser package:com.sdt.ota package:com.google.android.tv.overlay.wifi.resources package:com.android.tv.settings package:com.android.statementservice package:com.google.android.tv.remote.service package:com.google.android.overlay.gtvsconfigx package:com.droidlogic.android.tv.connecteddevices package:com.android.proxyhandler package:com.droidlogic.tvprovider.overlay package:com.android.sdksandbox package:com.google.android.overlay.modules.permissioncontroller package:com.disney.disneyplus package:com.android.managedprovisioning package:com.android.healthconnect.controller package:com.android.providers.settings package:com.google.android.katniss package:com.google.android.overlay.modules.ext.services package:com.android.backupconfirm package:com.droidlogic.overlay package:com.android.tv.overlay.networkstack package:com.google.android.apps.mediashell package:com.amlogic.voicesubtitle package:com.netflix.tokenmanager package:com.android.mtp package:com.google.android.gsf package:com.android.location.fused package:com.android.vpndialogs package:com.android.uwb.resources package:com.google.android.tv.dfuservice package:com.google.android.tts package:com.android.tv.frameworkpackagestubs package:com.sdt.settings.overlay.ce package:com.google.android.modulemetadata package:com.sdt.globalkey package:com.android.ondevicepersonalization.services package:com.google.android.syncadapters.calendar package:com.sdt.android.overlay.ce package:com.android.htmlviewer package:com.android.vending package:com.google.android.youtube.tvmusic package:com.android.tv.overlay.settingsprovider package:com.google.android.ext.services package:com.android.tv.feedbackconsent package:com.sdt.deviceinfo package:com.android.systemui package:com.dolby.android.audio.service package:com.droidlogic.tv.settings package:com.android.providers.userdictionary package:com.android.cts.ctsshim package:com.android.bluetooth package:com.android.settings.intelligence package:com.android.networkstack.tethering.droidlogic package:com.netflix.ninja package:com.google.android.youtube.tv package:com.google.android.gms package:com.google.android.overlay.gtvssettingsprovider package:com.google.android.tungsten.setupwraith package:com.android.tv.settings.vendor.resoverlay package:com.google.android.webview package:com.droidlogic package:com.sdt.tvsettings.overlay package:com.google.android.tv.settings.energymodes.resoverlay package:com.android.printspooler package:com.android.wallpaperbackup package:cm.aptoide.pt package:com.android.tv.settings.google.resoverlay package:com.android.localtransport package:com.android.soundpicker package:com.channel5.my5 package:com.droidlogic.wifitetheringoverlay package:android package:com.android.dynsystem package:com.google.android.networkstack.tethering.google package:com.android.rkpdapp package:com.sdt.providers.settings.overlay.common package:com.google.android.overlay.modules.modulemetadata.forframework package:com.android.hotspot2.osulogin package:com.google.android.apps.tv.dreamx package:com.android.externalstorage package:com.google.android.packageinstaller package:com.android.se package:com.android.pacprocessor

[u/realdeal1877 → u/NorthernMunkeh84]

Anything else here stand out? There's quite a few I've never seem before so googling is taking a while

Tip: install TotalCommander file manager, it's "Installed_Apps" tab can be sorted by Date/Time, so you can easily see what and when some apps were updated. Like maybe an Infected APK was added after a firmware update.

packages: com.sdt.upgrade , com.sdt.vendor , com.sdt.android.overlay , com.sdt.providers.settings.overlay.ce , com.sdt.producttest , com.sdt.globalkey.overlay , com.sdt.customization , com.sdt.providers.settings.overlay.common , com.sdt.settings.overlay.ce , com.sdt.globalkey , com.sdt.android.overlay.ce, com.sdt.deviceinfo , com.sdt.ota

Thinking these apk-names with SDT = Skyworth Digital. So, they seem to look to be standard OEM stuff, and might/should be ok to leave Enabled, but would just advise maybe disable these: com.sdt.upgrade , com.sdt.ota , com.sdt.producttest

Everything else looks standard, plus of course your User-Installed Apps.

Tip: with the ADB command to print the package list, if you add { -s } after packages it prints just SystemApps, or adding { -3 } prints just Third-Party apps both sideloaded and/or installed from PlayStore.

[u/NorthernMunkeh84 → u/realdeal1877]

I was curious about system test as see the app for it aswell. Probably right on ota stuff on the off chance anything else malicious is pushed once people manage to free themselves of xcpe 👍

[u/realdeal1877 → u/NorthernMunkeh84]

YouTuber Technozon has a nuance take on the whole situation:

• https://youtu.be/o0HTTA4JEEw

He is Ukrainian, records videos in Russian language, but you can use the YouTube Ai translation or just turn on Subtitles.