decrypted · 4 november 2026 · vulnerabilities and patching · supply chain · uk policy and law

A million TV boxes shipped already compromised, and Google blames the maker

Google said this week that it has dismantled a botnet of more than 1.3 million Android TV boxes, and the unusual part is who it blames: the manufacturer. Google's threat intelligence group attributes the XCPE network, with high confidence, to Videostrong Technology, a China-based maker of set-top boxes. If that assessment is right, nobody hacked these devices after purchase. They left the factory already working for someone else.

What was in the box

The backdoor, called x.cpe, sat in the firmware itself and ran with system privileges. Think of a hire car delivered with a spare key already cut and held by the dealer. Uninstalling the app achieved nothing, because it reinstalled itself from a protected partition on reboot. Google also says it switched off Play Protect, the on-device malware scanner, by changing a verification setting.

Videostrong then rented the access out. Google says affiliates loaded modules that resold the owner's home broadband as a residential proxy, committed advertising fraud and installed further malware. The backdoor could run shell commands, capture the screen and open a reverse shell, a connection that lets an attacker in from outside.

How it passed the tests

Google's compatibility and security testing exists to stop exactly this. Google says the malicious code was loaded after the device's first boot, using obfuscation, to slip past it. That is the design flaw in plain view: certification judged the box as it arrived, not as it behaved a week later. Google has banned Videostrong and any future affiliates from building certified Android devices or preloading Google apps, and says it is improving firmware integrity checks on certified Android TV devices.

The reporting I read does not break out UK numbers. Google says telehealth devices, karaoke machines and digital signage were also infected, and all of it moves through the same global supply chain that UK buyers use.

What the defender sees

Very little. The tell is on the network: a television talking to servers it has no business with, or a steady overnight stream of outbound traffic. Google's post lists the control domains and addresses, which a network team can search for in DNS logs, the internet's address book lookups. Google's head of disruption operations told The Record that cutting those domains leaves the malware effectively benign, but the code remains on the device.

The design lesson

Secure by Design says the buyer should not have to audit the maker. Cheap connected hardware ends up in waiting rooms, care homes and meeting rooms, usually on the same network as everything else.

The cost of applying the lesson is modest. Put anything you did not build yourself, such as televisions, signage and conference kit, on a separate network segment with no route to staff systems, and let it out only to the services it needs. In procurement, ask who built the firmware and how updates are signed, and do not accept a certification badge as the whole answer.

Also this week

The NCSC's annual review. The NCSC published State of the Cyber Nation on 3 November. It judges it "highly likely" that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. Chief executive Richard Horne is set to say the cause is not that AI invented new attacks, but that long-tolerated weaknesses can now be found and exploited at scale, after years of "doing tech on the cheap". The government is putting £60 million into the first phase of Cyber Shield and £70 million into a National Exposure and Real-Time Vulnerability Centre. That is the Secure by Design argument from the regulator itself: fix the foundations first.

How Binance was robbed. Binance published a security report on 3 November on its record theft of 29 October. CNBC reports that the affected assets were put at $6.34 billion, with 98% replenished. The attackers prepared from June, when an engineer installed a tampered Homebrew package while looking for an AI coding tool. In September they posed as recruiters and gave another engineer a coding exercise hiding malware. Binance's co-chief executive Richard Teng said they then moved through internal AI tools to reach the system that authorises wallet transactions, and acknowledged the FBI has linked the attack to North Korean hackers tied to TraderTraitor. Any UK firm with developers should ask whether a laptop that installs tools found by search is one hop from signing authority.

An exploited WordPress flaw. CISA added CVE-2026-119977, the public reference number for a WordPress Core race condition, to its KEV list of flaws known to be exploited, on 3 November. BleepingComputer reports that it lets unprivileged remote attackers run code during full-package core upgrades, and that Wordfence blocked 13,095 attacks against it in 24 hours. WordPress 7.1.4, a security release, came out on 28 October, and its notes urge immediate updating. Check your version rather than assume.

Sources

If you want a second pair of eyes on how your own estate handles devices nobody chose, get in touch.