Android TV Box Botnet: Google Cuts Ties With Videostrong

An Android TV box botnet of about 1.3 million devices was deliberately built by one of Google's own manufacturing partners, Google says. The company has dismantled the backdoor and cut ties with Shenzhen-based Videostrong Technology Co., which is now banned from building or selling certified Android devices, The Verge reported on November 2.

What Google says happened

According to Google, the backdoor was "intentionally developed, deployed, and operated for financial gain". Infected devices were used without their owners' knowledge for ad fraud, data theft and routing unauthorised network traffic.

Google said Videostrong made money by selling access to criminal affiliates and loading their malware onto infected devices. Those extra modules were used to:

• commit advertising fraud;
• quietly enrol devices into residential proxy networks;
• install further malware.

Google also disrupted the command-and-control domains used by the affiliates. Because those groups spread their malware through other channels too, Google estimates the takedown will cut off access to at least 10 million additional compromised devices.

Not just TV boxes

The malware was built directly into many device models and brands over several years. Most were Android TV set-top boxes, but Google said it also found it in other Android-based gadgets, including telehealth devices, karaoke machines and digital signage. Google says Videostrong used obfuscation to load the malware after a device was switched on for the first time, and that it has changed how it reviews device manufacturers.

How to protect your streaming box

Cheap streaming boxes are popular with households, condos and bars that want international channels. If you use one, these basic steps reduce your risk:

• Buy devices that are Google Play Protect certified from reputable brands and sellers.
• Be wary of very cheap, unbranded boxes that come preloaded with unofficial apps.
• Keep the device updated, and unplug any box that behaves strangely or slows your home network.
• Remember that malware built into firmware may not be removed by a normal factory reset.

For more on staying safe online, see our guides to the best VPN services for privacy and the best password managers, plus our explainer on Google Gemini app integration.

Photo: Android TV-based Tracer set-top box, by Oliwier Jaszczyszyn (kontrabanda.net) / Wikimedia Commons, CC BY-SA 4.0. The device pictured is not linked to the botnet.