Google cut ties with Android partners after Videostrong turned 1.3 million connected boxes into a botnet

Backdoor reached many devices

Google says the backdoor was built into 1.3 million devices made by Videostrong Technology Co. The company says the devices were used without their owners’ knowledge for activities including ad fraud, data exfiltration, and routing unauthorized network traffic.

The malware appeared in multiple models and brands over several years, Google says. Most affected devices were Android TV set-top boxes, but the company also found infections in Android-based telehealth devices, karaoke machines, and digital signage devices.

Google describes financial motive

Google says Videostrong intentionally developed and operated the backdoor for financial gain. It alleges the manufacturer sold access to criminal affiliates, which loaded additional malware onto infected devices.

According to Google, the affiliates’ modules conducted ad fraud, enrolled devices in residential proxy networks, and installed further malware on affected XCPE devices. Google also took steps to disrupt the command-and-control domains used to operate those modules.

Company cuts ties

Google says it used obfuscation techniques to load malware after devices were first switched on. The company also changed its review process for device manufacturers following the incident.

Google assesses wider impact

Google says disrupting the affiliates’ command-and-control domains will cut off access to at least 10 million additional compromised devices. It notes that the affiliates used distribution channels beyond XCPE, so the estimate concerns devices beyond those directly tied to Videostrong.

The company’s account describes a botnet spanning consumer streaming hardware and other connected equipment. Owners were not aware their devices were being used in the reported activity.