Google: Videostrong Pre-Installed Malware on 1.3M Android Devices
Google says Chinese manufacturer Videostrong Technology deliberately built a backdoor into more than 1.3 million Android devices, and has banned the company.
Google says Chinese manufacturer Videostrong Technology deliberately installed malware on more than 1.3 million Android devices, creating a botnet that gave criminals access to users' devices and home internet connections without their knowledge. In response, Google has barred the company from making or selling certified Android devices and from supplying Android software.
According to Google's blog post, the Shenzhen-based company planted the backdoor mainly in Android TV set-top boxes. Google says it has high confidence that Videostrong developed, deployed and operated the backdoor and the malicious network on purpose, for financial gain. It stressed this was not the act of a single employee or a software development mistake.
How the malware worked
The malware, named xcpe, was built into the devices at the factory. On first boot it gained system-level privileges. Google says it could install apps silently, run commands, take screenshots and collect account and device data. It could also turn a device into a residential proxy, routing other people's traffic through the owner's home connection.
Infected devices were used for ad fraud, data theft, unauthorized traffic routing and the installation of further malware. Most were Android TV boxes, but the malware also turned up on telehealth devices, karaoke machines and digital signage. The campaign reached more than 200 countries and affected multiple models and brands over several years. Google did not name the specific devices.
Videostrong, founded in 2011, works as both an OEM and an ODM, and had an agreement with Google to build certified Android devices. Its website claims its products serve more than 100 million households in over 60 countries.
The takedown
Google took legal action to shut down the domains and servers that controlled the network, changed its device review procedures and is improving checks on the firmware of certified Android TV devices. The operation involved Japan's National Police Agency and security firms including Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Partners also disrupted command-and-control domains used by more than 12 other malware families. Google estimates this will cut criminals' access to at least 10 million more compromised devices distributed through channels outside the XCPE network. Charlie Snyder of Google's Threat Intelligence Group said such operations raise the cost of criminal activity and show that the infrastructure criminals rely on is within reach.
The malware likely no longer works as before, even on infected devices, but identifying affected units requires more information from Google. The company advises buying internet-connected devices such as set-top boxes from trusted manufacturers. Similar cases include the BadBox network, disrupted by German authorities last year, and Vo1d, reported to have infected about 1.6 million Android TVs.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
More from this day
See all →
GitBook Breach: AI-Assisted Attack Exposes Infrastructure Keys
CrowdStrike Buys Fiddler AI and Dreadnode for Nearly $500M
Thai virtual bank Clicx picks Thought Machine for core banking
