Google says Videostrong backdoored 1.3 million Android devices
Google says partner Videostrong built a backdoor into 1.3 million devices for a botnet, has dismantled it and banned the firm from certified Android.
The story in focus
Google says Android manufacturing partner Videostrong built a backdoor into 1.3 million devices and turned them into a botnet, per The Verge. Google says it dismantled the backdoor, cut ties with the Shenzhen-based firm and banned it from certified Android devices and software.
- Google attributes the backdoor and botnet to Shenzhen-based Videostrong Technology, which it says acted for financial gain.
- Google says it dismantled the backdoor and banned Videostrong from building or selling certified Android devices or supplying their software.
- The malware affected Android TV set-top boxes plus telehealth devices, karaoke machines and digital signage.
- Google says disrupting affiliate command-and-control domains will sever access to at least 10 million additional compromised devices.
What Google says Videostrong did
Google says manufacturing partner Videostrong Technology Co. built a backdoor into 1.3 million devices, turning them into a botnet, The Verge reports. Google says the Shenzhen, China-based manufacturer developed and operated the backdoor and botnet intentionally for financial gain, and that infected devices were used without owners' knowledge for ad fraud, data exfiltration and routing unauthorized network traffic.
Google says Videostrong sold access to criminal affiliates and loaded their malware modules onto infected devices, and that the malware was built directly into many device models and brands over multiple years. Most were Android TV set-top boxes, but the botnet also reached Android-based IoT devices, including telehealth devices, karaoke machines and digital signage.
Google's response and scope
Google says it dismantled the backdoor, cut ties with Videostrong and banned the firm from building or selling certified Android devices or supplying software for them. The Verge reports that Google says Videostrong used obfuscation techniques to load the malware after devices first booted.
Google also says it disrupted command-and-control domains used by affiliate modules, and that because those affiliates distribute modules through other channels, the takedown will sever access to at least 10 million additional compromised devices. That figure is Google's own assessment, not a verified count.
Which devices did Google say the Videostrong backdoor infected?
Google says most were Android TV set-top boxes, but the botnet also reached Android-based IoT devices including telehealth devices, karaoke machines and digital signage, The Verge reports.
Sources & further reading
Help keep the record accurate. Send a correction.
