Cheap Android TV boxes came with malware, and Google says the manufacturer was behind it

Google has ended its partnership with Android TV box manufacturer Videostrong Technology after discovering malware pre-installed on over 1.3 million devices. Dubbed XCPE, the malicious software used sophisticated techniques to bypass Google's screening process and infiltrate a large botnet. The backdoor was found in firmware for multiple Videostrong devices, including the Mecool KTI and white-label Android TV boxes.

Synthient, a cybersecurity and fraud intelligence research group, identified at least 182 affected device models that were enrolled in the botnet. The malware exploited a firmware vulnerability to load malicious code upon the first device boot and was later rebuilt with a more resilient three-stage architecture. In addition to Android set-top boxes, the malware was also detected in telehealth devices, karaoke machines, and digital signage.

Once installed, the backdoor enabled criminals to carry out ad fraud, steal data, capture screenshots, inject keystrokes, and open remote shells. Infected devices were also used to route unauthorized traffic to their command-and-control servers. Google had identified the malware in various device models from multiple brands and worked with international law enforcement agencies and cybersecurity firms to shut down the botnet's command-and-control domains.

To prevent future occurrences, Google has barred Videostrong and its affiliates from manufacturing certified Android devices or supplying software to other Android vendors and partners, and has bolstered its certified Android program to ensure firmware integrity.