KUALA LUMPUR: Cybersecurity authorities have sounded the alarm over a sophisticated new threat targeting Android TV boxes, revealing that malicious XCPE software is hardcoded into device firmware during manufacturing, long before it reaches consumers.
Awani reported on Monday (Nov 9) that Dr Megat Zuhairy Megat Tajuddin, the National Cyber Security Agency (Nacsa) chief executive, said this represents a dangerous evolution from traditional malware, which typically requires user interaction, such as downloading a malicious app or clicking a suspicious link, to cause an infection.
Instead, XCPE possesses deep system-level privileges and advanced persistence mechanisms. This lets the malware automatically reinstall itself from protected system partitions even after users try standard remediation methods, making it nearly impossible to purge through conventional application uninstalls or factory resets.
Once activated, infected devices can be quietly conscripted into botnets, turning everyday home entertainment systems into residential proxies to mask illicit online traffic.
The malware can collect sensitive personal data and login credentials, execute instructions remotely via command-and-control infrastructure, and serve as a breach point to scan and exploit vulnerabilities in other devices across the home network.
Despite running actively in the background, the malware is notoriously difficult for average users to detect, as infected Android TV boxes continue to function normally on the surface.
To mitigate these risks, the agency urged manufacturers to embrace "security by design" principles, ensuring that cybersecurity is integrated from the ground up during the initial development phase.
Additional recommended safeguards for users include keeping firmware updated regularly, tightening access controls, and implementing network isolation to prevent an infection on one device from spreading to others.
Megat Zuhairy acknowledged that while the rapid expansion of the Internet of Things, from smart refrigerators and CCTV cameras to smart televisions, brings undeniable convenience, it simultaneously broadens the attack surface for cybercriminals.
However, he said that the solution lies in smarter engineering and proper configuration rather than shunning technology altogether.
