// 9TO5GOOGLE — MOBILE & WEB
Google shuts down a sneaky malware backdoor on millions of Android TV and Google TV boxes
Google has confirmed that an Android TV device maker snuck a backdoor for malware onto certified devices, which is leading to security improvements for the ecosystem as a whole.
In a post today, Google confirmed that it has cut ties with “Videostrong,” a company that was manufacturing certified Android TV boxes. This is due to the company building in a backdoor that it could sell access to, including the distribution of malware. Google has taken legal action to block the domains and servers that “Videostrong” was using to control the XCPE botnet and malware modules and banned the company and its subsidiaries from selling certified Android devices going forward, or selling software to any other certified vendors.
We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates. We believe this campaign wasn’t an isolated rogue insider or a development oversight. As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps.
Synthient (via The Hacker News) compiled a list of potentially affected devices, with the focus being on the Mecool brand that has made some well-known Android TV and Google TV boxes in the past. Mecool has been rumored to be shutting down.
Google somewhat admits that this was a failing on its part, as these devices were sold as “certified” Android devices with the implication that they were safe. The company explains that these bad actors “employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot.” With that in mind, Google is updating its review process to protect users against this type of behavior, and Google reiterates that “a device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust.”
Google’s shutdown of the domains and servers used to spread malware should leave affected Android TV and Google TV boxes safe to use – the company says that “taking down their C2 domains will sever access to at least 10 million additional compromised devices” – but owners may still want to consider alternate options.
Follow Ben: Twitter/X, Threads, Bluesky, and Instagram
FTC: We use income earning auto affiliate links. More.