Google says Videostrong planted backdoor, forming botnet across 1.3 million set-top boxes

The short version

• Google says Videostrong Technology, a Shenzhen-based Android partner, secretly built a backdoor into 1.3 million devices to form a botnet.[The Verge]
• The infected set-top boxes were used without owners' knowledge for ad fraud, data exfiltration, and unauthorized traffic routing.[The Verge]
• Google cut ties with Videostrong, banned it from certified Android production, and moved to block the botnet's control domains and servers.[The Verge · 9to5Google]
• Synthient's list of potentially affected devices centers on the Mecool brand, which has been rumored to be shutting down; the scope remains unclear.[9to5Google]

Key facts

• Google states that Shenzhen-based Videostrong Technology Co. secretly built a backdoor into 1.3 million devices to create a botnet.[The Verge]
• Google cut ties with Videostrong and banned it from building or selling certified Android devices or supplying software for them.[The Verge · 9to5Google]
• The infected devices were used without owners' knowledge for ad fraud, data exfiltration, and routing unauthorized network traffic.[The Verge]
• Google claims the backdoor and botnet were intentionally developed, deployed, and operated for financial reasons.[The Verge]
• Google has taken legal action to block the domains and servers Videostrong used to control the XCPE botnet and malware modules.[9to5Google]
• Synthient compiled a list of potentially affected devices, focused on the Mecool brand.[9to5Google]
• Google states that taking down the command-and-control domains will sever access to at least 10 million additional compromised devices.[9to5Google]

Sources

Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.

• One of Google’s Android partners turned 1.3 million set-top boxes into a botnetThe Verge
• Google shuts down a sneaky malware backdoor on millions of Android TV and Google TV boxes9to5Google