In early November, Malaysia's National Cyber Security Agency sounded an alarm about a threat that begins before anyone brings a device home. Some Android TV boxes, it warns, carry a malicious program called XCPE built into their firmware at the factory, so the intrusion is in place before a buyer ever switches the set on. The warning reminds us that trust in everyday objects now depends on decisions made far upstream, in design rooms and assembly lines, long before a household ever sees the product.
Pre-installed XCPE Malware Found in Android TV Boxes, Malaysia's Nacsa Warns Consumers and Makers
In early November, Malaysia's National Cyber Security Agency sounded an alarm about a threat that begins before anyone brings a device home. Some Android TV boxes, it warns, carry a malicious program called XCPE built into their firmware at the factory, so the intrusion is in place before a buyer ever switches the set on. The warning reminds us that trust in everyday objects now depends on decisions made far upstream, in design rooms and assembly lines, long before a household ever sees the product.
On Monday, November 9, Malaysia's National Cyber Security Agency, known as Nacsa, issued a warning about the Android TV boxes that sit in many living rooms. According to the agency, a malicious program called XCPE is written into the firmware of some of these devices during manufacturing. It is already inside the box before a buyer plugs it in. The account was reported by Awani and carried by The Star from Kuala Lumpur.
Chief executive Dr Megat Zuhairy Megat Tajuddin described XCPE as a far more dangerous kind of threat than ordinary malware. Most infections need the user to do something, like downloading a bad app or clicking a suspicious link. XCPE needs none of that, because it comes with the device itself.
Its design makes it stubborn. Holding deep system-level privileges, it can reinstall itself from protected system partitions, so uninstalling apps or performing a factory reset are described as nearly useless.
An infected box can be quietly drafted into a botnet, used as a residential proxy so others can route illicit traffic through a household connection, and made to collect personal data and login credentials. It can take remote commands and scan the home network for weaknesses in other devices. Because the box still works normally, nothing looks wrong to the owner.
Nacsa urges manufacturers to build in security from the earliest stage of development, and asks users to keep firmware updated, tighten access controls, and isolate their networks. Megat Zuhairy stressed that this is not an argument against connected technology, but a call for smarter engineering and proper configuration. The report does not name affected brands or models, or say how many devices are involved. What comes next is whether manufacturers respond, and whether updates and network isolation actually reach people already using these boxes.
On Monday, Nov 9, Malaysia's National Cyber Security Agency, known as Nacsa, put out a warning about the Android TV box sitting in many living rooms. According to the agency, a piece of malware called XCPE is written into the firmware of some of these devices while they are being made, so it is already inside the box before a buyer ever plugs it in. The account was reported by Awani and carried by The Star from Kuala Lumpur.
The warning came from Dr Megat Zuhairy Megat Tajuddin, Nacsa's chief executive. He described XCPE as a dangerous step beyond the malware most people know. Ordinary infections usually need the user to do something, such as download a malicious app or click a suspicious link. XCPE needs nothing of the kind, because it arrives as part of the device itself.
The design is what makes it hard to remove. XCPE holds deep system-level privileges and advanced persistence mechanisms. If a user tries to get rid of it, it can reinstall itself from protected system partitions. Uninstalling apps and performing a factory reset, the standard remedies, are described as nearly useless against it.
The agency laid out what an infected box can be made to do. It can be quietly drafted into a botnet. It can serve as a residential proxy, which lets other people route illicit online traffic through a household's internet connection and hide behind it. It can collect sensitive personal data and login credentials. It can take instructions remotely through command-and-control infrastructure. And it can act as a foothold, scanning the rest of the home network for vulnerabilities in other devices and exploiting them.
None of this is easy for an ordinary owner to notice. The malware runs in the background while the TV box keeps working normally on the surface, so nothing looks wrong.
Nacsa's advice is aimed at two groups. Manufacturers are urged to adopt "security by design," building cybersecurity in from the earliest stage of development instead of adding it later. For users, the agency recommends keeping firmware regularly updated, tightening access controls, and isolating the network so that an infection on one device cannot spread to others.
Megat Zuhairy was careful not to frame this as a case against connected technology. He acknowledged that the rapid growth of the Internet of Things, from smart refrigerators and CCTV cameras to smart televisions, brings real convenience and also widens the attack surface open to cybercriminals. In his view, the answer lies in smarter engineering and proper configuration, not in avoiding the technology.
The report does not name affected brands or models, say how many devices are involved, or explain how users can tell whether a box is compromised. What to watch next is how manufacturers respond to the call for security by design, and whether firmware updates and network isolation actually reach the people already using these boxes.
Vuoi la storia completa?
Leggi l'originale su The Star ↗
Technology