NACSA XCPE Warning: Malaysia's Cyber Agency Says Android TV Boxes Can Ship With Malware a Factory Reset May Not Remove

Malaysia's National Cyber Security Agency (NACSA) has warned that Android TV boxes can reach buyers with the XCPE malware already built into their firmware at the factory, where uninstalling apps or a factory reset is unlikely to reach it. The agency hasn't named any brand or model, and it gave no count of infected boxes in Malaysia.

Google and its partners disrupted the XCPE botnet earlier this month, and Malaysia was among the five countries with the most infected devices in TrendAI's count.

What NACSA said

NACSA chief executive Megat Zuhairy Megat Tajuddin gave the warning in an interview with Astro Awani. XCPE needs no app download and no click from the owner. It runs with system privileges and can reinstall itself from protected areas of the device.

A box carrying it can be drafted into a botnet or rented out as a residential proxy that hides criminal traffic. Sinar Harian reports him saying it can also steal login details and be used to attack other devices on the home network. Owners are unlikely to notice: an infected box keeps working normally while the malware runs in the background.

What the agency advises

For owners, NACSA's advice is to update firmware regularly, tighten access controls and isolate the device on the network, so an infection on the TV box can't spread to other devices. Makers are told to build in security from the earliest stages of device development.

Google's own advice when it announced the takedown was narrower: keep Play Protect switched on and buy set-top boxes only "from reputable manufacturers".