Google bans an Android TV maker after 1.3 million set-top boxes joined a botnet

Google has cut ties with a Shenzhen contract manufacturer. Software preloaded on that company’s Android TV set-top boxes turned more than 1.3 million devices into a botnet, Google said. Its threat intelligence group assessed with high confidence that Videostrong Technology built the backdoor itself and ran the network for money.

Devices carrying the component, which Google calls x.cpe or XCPE, were used for ad fraud and to lift data. They also routed other people’s traffic through home internet connections. Google said Videostrong sold access to criminal affiliates, who loaded their own modules onto the machines. The company has taken legal action to seize the control servers, and has banned Videostrong from building or selling certified Android devices.

The malware ran with system-level privileges, and it reinstalled itself from a separate partition whenever a user deleted it, Google said. The company described a three-stage design. A loader checked for analysis tools, then fetched modules that turn a television box into a proxy exit node or an ad-fraud client. Google assesses that shutting the affiliates’ command servers will sever access to at least 10 million further compromised devices, since the same groups distribute their modules through other channels. It did not break down that figure. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI helped.

Featured source: Google Threat Intelligence Group , The Verge .

Other Stories

Anthropic tells investors it may soon meet its own definition of self-improving AI

Anthropic’s revised filing for its initial public offering says internal estimates suggest the company “may imminently meet” its own threshold for progress driven by AI. The policy’s wording is “dramatically accelerated progress attributable to AI”. The document, filed on 2 November, adds that no current model has been designated as crossing that line. Anthropic said it had in the past failed to notice a significant acceleration in its development until afterwards. It also said it does not expect to build successive frontier models with Claude unsupervised. TechCrunch noted that a registration statement works as both disclosure and marketing.

Filed from: TechCrunch , SEC filing .

Apple reports record iPhone revenue and warns memory costs will rise again

Apple’s fiscal fourth-quarter revenue rose 12 percent to $114.5 billion. iPhone revenue was up 17 percent to $57.58 billion, even though the September refresh included only the pricier Pro models. Mac revenue rose 24 percent to $10.79 billion, services reached $31.57 billion and iPad revenue fell 10 percent. On the call, chief executive John Ternus called current memory pricing “unprecedented” and said costs would climb further in the December quarter. Apple said the increase would erode part of its gross margin.

Filed from: The Verge , The Guardian .

Germany warns lawmakers that spyware may have compromised their iPhones

Germany’s federal cybersecurity office has told members of the Bundestag and other public figures to assume their phones may be compromised. The warning followed Apple threat notifications about government-backed spyware. A government spokesperson, Stefan Kornelius, said Berlin was taking it seriously but did not say who had been targeted. Apple does not attribute attacks to particular governments, and it does not confirm whether a device was breached. According to one recipient, the notifications went to users in 99 countries.

Filed from: TechCrunch , Financial Times .

A Ukrainian receiver lets drone crews watch what Russian drones see

A Kyiv communications firm called CODE380 has built a pocket-sized receiver that shows Ukrainian drone crews what Russian drones are filming. The D·Vision SDR sweeps a wide band of radio frequencies for unscrambled video. It weighs about 10 ounces, less than half as much as its main domestic rivals, Defense News reported. Its range covers the 4.1 to 4.5 gigahertz band where Russia’s Molniya strike drones began sending video in June. Serhii Beskrestnov, a radio specialist advising Ukraine’s president, has warned crews not to trust any detector too far. He has also said a move to digital video would blind receivers of this kind.

Filed from: TechCrunch , Defense News .

Economists propose shaping AI incentives instead of inspecting models

A preprint by Dirk Bergemann, Andrew Koh and Stephen Morris asks how to control AI agents whose preferences and capabilities are unknown. Their answer is to design rewards that make honesty and obedience the best strategy. One mechanism pays a model partly on how well its answers predict a second model’s output, which makes deliberate underperformance expensive. MIT Technology Review paired the paper with a proposal from Princeton’s Elad Hazan. He would train models as rotating solvers and auditors, and penalise both cheating and missed cheating. Both remain proposals, and the approach assumes that agents behave rationally.

Filed from: MIT Technology Review , arXiv .

Octopus Energy, CATL and Ampace look to sodium-ion home batteries

Octopus Energy, CATL and Xiamen Ampace Technology have signed a memorandum of understanding to explore new home batteries. The work will begin in the European markets where Octopus retails electricity. The announcement points to CATL and Ampace research on sodium-ion chemistries, high-density cells and longer-lived systems. Octopus would contribute smart tariffs and software that pools batteries into a virtual power plant. No products, prices or volumes were disclosed, and the three companies described the arrangement as exploratory.

Filed from: Octopus Energy , TechRadar .

From the Community

Tor Browser 16.0 rebuilds its settings and can hide window titles

Tor Browser 16.0 is the project’s first stable release built on Firefox ESR 153. It rebuilds the settings pages to match Firefox’s recent redesign. An opt-in option replaces every window title with “Tor Browser”, so other programs cannot read the name of the page a user has open. The project says it has not had time to evaluate side effects, particularly for people who rely on screen readers. The release also adds native support for 64-bit ARM Linux and ends support for 32-bit x86 Linux.

Filed from: Tor Project .

NIST publishes a cybersecurity guide for solo business owners

NIST has released Cybersecurity White Paper 50, a plain-language guide for firms whose only paid employee is the owner. NIST says more than 28 million U.S. businesses fall into that group. The guide maps recommended actions to the NIST Cybersecurity Framework 2.0. Each action gets a rationale, a starting point and a next step for a company that grows. The publication closes with worksheets for inventorying assets and three worked examples of solo businesses. It updates a broader publication aimed at small businesses of any size.

Filed from: NIST .