Glonce

Google says Android partner Videostrong infected 1.3 million devices

securityThe Glonce editorsVerge🔥68Glonce rating68Impact68Novelty55Relevance80Surprise60Players70Credibility85
Google says Android partner Videostrong infected 1.3 million devices

Google says one of its Android manufacturing partners secretly built a backdoor into 1.3 million devices and turned them into a botnet. The partner is the Shenzhen, China-based Videostrong Technology Co. Google says it has dismantled the backdoor and "cut ties" with the company, which has been banned from building or selling certified Android devices or supplying software for them.

According to Google, the infected devices were used without their owners' knowledge for "malicious activity" such as ad fraud, data exfiltration and routing unauthorized network traffic. Google claims the "backdoor and botnet were intentionally developed, deployed, and operated for financial gain."

Google describes how the money was made: Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices. The secondary modules conducted ad fraud, silently enrolled infected devices into residential proxy networks, and loaded additional malware onto XCPE-compromised devices. Google also took action to disrupt the command and control (C2) domains that operate these affiliate modules. Because the affiliates have distribution channels for their modules beyond XCPE, Google assesses that taking down their C2 domains will sever access to at least 10 million additional compromised devices.

The problem was not confined to one product. The malware was found "built directly into many different device models and brands over multiple years." Most of the affected devices were Android TV set-top boxes, but the botnet also infected other Android-based IoT devices, including telehealth devices, karaoke machines and digital signage devices.

Google says Videostrong used "obfuscation techniques" to load the malware onto users' devices after they booted the hardware for the first time. Google also says it changed its review process for device manufacturers after the incident.

Key facts

  • Google says Videostrong Technology Co. of Shenzhen, China, an Android manufacturing partner, built a backdoor into 1.3 million devices and ran them as a botnet.
  • Google has dismantled the backdoor, cut ties with the company and banned it from building or selling certified Android devices or supplying software for them.
  • Infected devices were used for ad fraud, data exfiltration and routing unauthorized traffic; Videostrong sold access to criminal affiliates, whose modules also enrolled devices in residential proxy networks.
  • Google assesses that disrupting the affiliates' C2 domains will sever access to at least 10 million additional compromised devices.
  • Most devices were Android TV set-top boxes; others included telehealth devices, karaoke machines and digital signage, and Google says it changed its manufacturer review process.

Why it matters

The usual picture of a pre-infected Android box is a cheap device with sloppy security. Here Google says the maker itself did it on purpose: the backdoor and botnet were, in Google's words, "intentionally developed, deployed, and operated for financial gain." The malware was built into the devices, and Google says it was loaded after the first boot using obfuscation techniques. The scale is also large: 1.3 million devices, plus at least 10 million more that Google assesses were reachable through the affiliates' infrastructure.

Who it affects

Owners of the affected devices, who per Google had no knowledge their hardware was being used for ad fraud, data exfiltration and unauthorized traffic routing. Most were Android TV set-top boxes, but telehealth devices, karaoke machines and digital signage were also hit. It also affects Videostrong, now barred from building or selling certified Android devices or supplying software for them, and other device makers, since Google says it changed its review process for manufacturers.

How to use it

This is a disclosure, not a tool, and the source gives owners no steps to take. It does not say how many of the devices are in any particular country or whether owners can clean their devices. It also does not name specific brands or models, so a reader cannot tell from the report alone whether a given box is affected.

How solid is it

Everything rests on Google's own statements as relayed by The Verge, including the claim of intent and the 10 million figure, which is Google's assessment of additional devices rather than part of the 1.3 million. The report gives no date for the discovery, takedown or ban, and does not say how Google found the backdoor. It does not report any response from Videostrong.

Risks and caveats

The 1.3 million count and the intent claim are Google's, with no independent confirmation in the report. The at least 10 million figure is an assessment and a lower bound. The report does not explain what XCPE is beyond using it as the name of the compromised backdoor and botnet, and it does not say what Google changed in its manufacturer review process, so how well the fix works is unknown. Devices already in homes may remain compromised; the source does not address this.

“backdoor and botnet were intentionally developed, deployed, and operated for financial gain”

— Google, as quoted by The Verge