Google cuts ties with Videostrong after 1.3 million Android boxes join botnet

Google has severed its business relationship with Videostrong Technology Co., a manufacturer based in Shenzhen, China. The move follows the discovery that the company embedded a backdoor in 1.3 million Android devices, creating a large-scale botnet.

According to Google, Videostrong intentionally developed and operated the malware for financial gain. The infected hardware included Android TV set-top boxes, but the botnet also comprised Android-based IoT devices such as telehealth monitors, karaoke machines, and digital signage units. The malware was present in multiple device models and brands over several years.

Google states that Videostrong monetized the backdoor by selling access to criminal affiliates. These affiliates loaded malware modules onto the compromised devices to conduct ad fraud, enroll them in residential proxy networks, and route unauthorized network traffic. The company also discovered that Videostrong used obfuscation techniques to install the software after users first booted the hardware.

In response to the breach, Google dismantled the backdoor and disrupted the command and control domains used by the affiliates. Google estimates that taking down these domains will sever access to at least 10 million additional compromised devices beyond the initial 1.3 million.

Videostrong is now banned from building or selling certified Android devices and from supplying software for them. Google says it has modified its review process for device manufacturers to prevent similar incidents in the future.