Android TV maker secretly infected 1.3M devices with malware
What's the story
Google has revealed that one of its manufacturing partners, Shenzhen-based Videostrong Technology Co., built a backdoor into 1.3 million devices without their owners' consent. The tech giant has since dismantled the backdoor and severed ties with the manufacturer. Videostrong is now banned from making or selling certified Android devices or providing software for them.
Malware misuse
Backdoor was used for ad fraud and data theft
The infected devices were exploited for a range of malicious activities, including ad fraud, data theft, and unauthorized network traffic routing.
Google said the "backdoor and botnet were intentionally developed, deployed, and operated for financial gain."
Videostrong allegedly monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices.
Global reach
Devices from multiple manufacturers were infected
The botnet's impact wasn't limited to a single device.
It was found "built directly into many different device models and brands over multiple years," mostly Android TV set-top boxes but also other "Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices."
The campaign affected devices in more than 200 countries.
Infection method
Backdoor gained system-level access to devices
The backdoor, known as x.cpe, was embedded in the device from the factory itself. Once a user booted the device for the first time, it gained system-level access.
From there, this malware could silently install apps, execute commands, capture screens, and collect account details as well as device info.
It could even turn infected devices into residential proxies for routing other people's internet traffic through owners' home connections without their knowledge or consent.
Joint effort
Google worked with multiple partners to take down botnet
Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to dismantle this botnet.
The partners also took down command-and-control domains used by over a dozen malware families.
Google estimates this will cut criminal access to at least 10 million more compromised devices distributed through channels other than XCPE.