Google Shuts Down Videostrong Backdoor in Millions of TV Boxes

How the scheme worked

Synthient found that the flaw gave attackers system-level privileges, enabling everything from file management to remote code execution. Google says Videostrong monetized the access by selling it to criminal affiliates, who installed their own malware modules. Those modules carried out ad fraud, silently enrolled devices into residential proxy networks and installed further malware.

Because Videostrong was both an OEM and an ODM building certified devices, it could preload Google apps, which lent its products added legitimacy. Google says the company used obfuscation to exploit a gap in its compatibility and security testing, loading the malicious code only after the device's first boot. Google has since changed its review process.

Google's response

Google took down the servers and domains used to install malware, control XCPE and distribute other malware families, as well as the command-and-control domains run by the affiliates' modules. It has also barred Videostrong and any current or future affiliate or subsidiary from making or selling certified Android devices, and from supplying software to other certified manufacturers.

Synthient and Google Threat Intelligence have published technical reports. Researchers urge owners of these boxes to inspect them or stop using them, though the practical situation is murkier: it is still unclear what will happen to units from the affected brands that are being sold through resellers.