Google says Android partners turned 1.3 million boxes into a botnet for ad fraud and data theft

Google severs manufacturer ties

Google says Videostrong Technology, an Android manufacturing partner based in Shenzhen, China, put a backdoor in 1.3 million devices. It has since taken steps to shut down the backdoor and ended its relationship with the company.

Videostrong is now barred from making or selling certified Android devices, as well as from supplying software for them. Google says the backdoor was deliberately created and run to make money.

Devices used for illicit activity

According to Google, the compromised devices were used without owners’ awareness for activities including ad fraud, data exfiltration and unauthorized network traffic. Videostrong allegedly sold criminal affiliates access and installed their malware modules on affected devices.

Those modules also enrolled devices in residential proxy networks and added further malware, Google says. The company acted against command-and-control domains used to operate the affiliate modules; it estimates that this could cut access to at least 10 million other compromised devices.

Infections crossed device types

Google says the malware was included in numerous models and brands over several years, rather than being limited to one product. Most affected devices were Android TV set-top boxes, but the infections also reached Android-based internet-connected equipment.

That equipment included telehealth devices, karaoke machines and digital signage devices. Google says Videostrong used concealment methods to load malware after devices were first powered on.

Google changes its review process

Google says it revised its review process for device manufacturers following the incident. The company did not provide further details about those changes in the account described here.