Google Dismantles Botnet Hidden in 1.3 Million Android Set-Top Boxes

1.3 million Android devices contained a hidden backdoor that allowed a manufacturer to control them remotely without owner consent. Google identified the breach in hardware produced by Videostrong Technology Co., a company based in Shenzhen, China.

Google stated that Videostrong intentionally developed the botnet infrastructure to generate revenue. The company sold access to the compromised devices to criminal partners. Those partners used the network to run ad fraud campaigns, extract data, and route unauthorized traffic through residential proxy services.

The malware was embedded directly into the firmware of various device models over several years. While most affected units were Android TV set-top boxes, the infection also spread to other Internet of Things devices. These included telehealth monitors, karaoke machines, and digital signage displays.

Videostrong used obfuscation techniques to install the software after a user first powered on the hardware. Google reported that it has now removed the backdoor and severed its business relationship with the manufacturer. The company also banned Videostrong from building or selling certified Android devices and supplying related software.

Google disrupted the command and control domains that managed the malware modules. The company assessed that this action would cut off access to at least 10 million additional compromised devices that used the same distribution channels. Google also revised its review process for device manufacturers following the incident.