Google shuts down a sneaky malware backdoor on millions of Android TV and Google TV boxes

Google has acknowledged the presence of a backdoor for malware within certified Android TV devices, leading to enhanced security measures for the entire system. In a recent statement, Google announced the termination of its partnership with "Videostrong," a company responsible for manufacturing certified Android TV boxes. This decision stemmed from the company's inclusion of a backdoor enabling unauthorized access to distribute malware.

Legal action has been taken against "Videostrong" to block the domains and servers used for controlling the XCPE botnet and malware modules, while the company and its subsidiaries have been prohibited from selling certified Android devices or providing software to other certified vendors.

Upon discovery, malicious software was found embedded in numerous device models and brands over several years, supported by a dedicated infrastructure and continuously evolving configurations to avoid detection and manage affiliates. Google believes this campaign is not an isolated incident of insider sabotage or development error. Consequently, Google has severed ties with Videostrong and barred them from manufacturing devices with preloaded Google apps.

As a result of this situation, Synthient (via The Hacker News) compiled a list of potentially impacted devices, focusing on the Mecool brand, which has previously produced popular Android TV and Google TV boxes. Mecool is reportedly contemplating closure. Google admits that this issue stems from a deficiency in their testing procedures, as these devices were marketed as "certified" Android products, suggesting they were secure.

The company explains that the malicious actors "used obfuscation techniques to exploit a gap in our tests and install malicious code after the device's initial boot."

In response, Google is refining its review process to safeguard users from such conduct, emphasizing that "a device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust." While Google's shutdown of the domains and servers utilized for spreading malware should render affected Android TV and Google TV boxes safe for use – with the company stating that "taking down their C2 domains will sever access to at least 10 million additional compromised devices" – users may still wish to consider alternative options.