Google Says Videostrong Built a 1.3 Million-Device Android Botnet Into Its Own TV Boxes

In October, over a million Android devices, primarily TV set-top boxes, were disconnected from their control servers, marking the takedown of a massive 1.3 million-device Android botnet built by Shenzhen device maker Videostrong. Google, along with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI, took action against the control servers.

The backdoor, known as x.cpe, was intentionally integrated into Videostrong's devices and sold to criminal buyers. The backdoor allowed operators to install apps, run commands, capture screens, steal account details, and open reverse shells. Criminals used the compromised devices to create residential proxies and ad fraud engines, affecting 206 models across 1,472,554 infected devices. The backdoor also appeared on telehealth devices, karaoke machines, and digital signage, posing a wider threat.

Google could not remove the backdoor as it resides in the firmware and reinstalls upon reboot. The only solution is vendor action, platform protection, or device replacement. Google banned Videostrong from certified Android and from supplying software to other certified makers. Google also admitted a process failure in its compatibility and security testing, allowing the malicious payload to bypass and load after the device's first boot.

Despite the takedown, more than a million boxes still harbor the backdoor, leaving the issue unresolved.