One of Google’s Android partners turned 1.3 million set-top boxes into a botnet

Google alleges that one of its Android device manufacturers deliberately embedded malware into 1.3 million devices, transforming them into a botnet. The compromised devices were utilized for illicit activities such as ad fraud, data theft, and unauthorized network traffic routing. The manufacturer, Videostrong Technology Co. based in Shenzhen, China, has been barred from producing or selling certified Android devices and supplying software for them.

Google has dismantled the backdoor and severed ties with the company, having identified the malware present in numerous device models spanning several years. Most affected devices were Android TV set-top boxes, but other IoT devices like telehealth equipment, karaoke machines, and digital signage were also infected. Videostrong allegedly monetized the backdoor by selling access to criminals and loading their malware onto infected devices.

Google has disrupted the command and control domains of these affiliates, which are expected to isolate an additional 10 million compromised devices. The company has also revised its review process for device manufacturers following the incident.