A Letter to Our Partners:
How Plume Security Labs and Google shut down the X.CPE botnet

Today, Plume, along with Google and other industry partners, announced a coordinated takedown of X.CPE, a global botnet hidden in more than 1.3 million set-top boxes across over 200 countries worldwide. Plume Security Labs identified it in our network telemetry, traced it to a hidden agent in the boxes’ Android firmware and shared our findings with Google. Working with our partners, we have now eliminated the threat.

We are informing you directly because some of your subscribers may have had affected devices. This threat was not visible on your end. The takedown happened behind the scenes and subscribers did not notice it. Google’s assessment is that the threat has now been fully remediated.

A few months ago, our telemetry flagged a suspicious domain. When we searched further, devices in many countries kept connecting to that same domain. That trail led us to a hidden agent inside the firmware of Android-based TV set-top boxes. It appeared the agent (X.CPE) was initially installed through the device supply chain, before the box ever reached a home. Subscribers were never asked for consent or given a way to opt out.

Our research puts the botnet in more than 200 countries.

“A set-top box can work perfectly and still be working against the household it sits in. You cannot judge a connected device by whether it plays video,” said Robert Neumann, VP Security Labs at Plume. “You have to watch what it does on the network itself. That is how Plume Security Labs found X.CPE, and it is the lens we bring to our service provider partners every day.”

To a subscriber, the box looked and worked like any streaming device. Behind the scenes, the botnet controllers used it to:

• Resell the household’s bandwidth through residential proxy software
• Deliver video content for third parties
• Show advertising through screensavers
• Collect device, network and account information

After Plume Security Labs alerted Google, Google discovered ad fraud and additional backdoors loaded onto the devices. For you as a service provider, this is a supply chain risk that is invisible in everyday performance. A box can work perfectly and still generate unexplained traffic, expose subscriber information and undermine trust in your broadband service.

Plume worked closely with Google’s Threat Intelligence Group, which led the disruption with partners including TrendAI, Lumen, HUMAN Security, Synthient, and Japan’s National Police Agency.

Google’s actions included:

• Legal action to take down the domains and servers used to control the X.CPE botnet
• Legal action against the control domains of more than a dozen malware families loaded through it
• A ban on the responsible manufacturer from building and selling certified Android devices
• Changes to protect the integrity of certified firmware

Google estimates the action also cut attackers’ access to more than 10 million additional compromised devices.

The Plume platform is engineered with performance and security as our utmost priority. Threats like this are built to hide inside trusted devices. They don’t always affect individual device performance; instead, they show up in how the whole network behaves. It takes massive amounts of data to be able to uncover a threat such as this.

Plume is the only network-level cybersecurity company dedicated to broadband service providers that has worked with Google on this effort. It reflects Plume’s investment in security and recognizes the excellence driving our technology organization to build a product that delivers safe homes for our clients.

The Plume platform allows operators to leverage Plume AI to monitor every user, device and application running on their network. It flags any unusual patterns to ensure a consistent, safe experience for all subscribers.

“Protecting the connected home requires visibility into threats that subscribers cannot see and should not be expected to detect,” said Chris Griffiths, Chief Technology Officer at Plume. “By contributing deep broadband intelligence to this joint effort, we helped expose hidden supply chain risks and support coordinated action to make networks safer for service providers and their subscribers.”

Visibility into these security threats and insights is another reason we launched our latest product, Plume Console. Find out more here.

Google recommends that, going forward, service providers:

• Require independent firmware integrity audits from device suppliers
• Confirm that Android TV hardware is officially certified before bundling it
• Drop suppliers implicated in supply chain abuse

If your team has questions, your Plume representative is ready to help.

• Read Plume’s whitepaper on the event
• Read the press release
• Read Google’s blog
• Join our security webinar in November

Chris Griffiths, Chief Technology Officer
Robert Neumann, VP Security Labs