Certified Android TV Manufacturer Installed Backdoor in 1.3 Million Set-Top Boxes

Manufacturer Implants Backdoor

Google shut down a massive botnet operation involving an OEM and ODM manufacturer. According to the company blog, Videostrong Technology Co., which was a certified Android TV partner, purposefully installed a backdoor into 1.3 million set-top boxes and then sold access to criminal affiliates. This allowed for the installation of hidden software that the bad actors could use to conduct ad fraud, build residential proxy networks, and even remotely install malware on the device itself to target the end-user.

Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices, the company said in the Google Cloud blog post. It also added that the malicious software was built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates. Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps.

Evolution of the Malicious Firmware

While Google did not mention when Videostrong started loading malware into its products, the company said that the pre-installed malware evolved into a complex, three-stage design in 2024. This meant that the manufacturer has been exploiting millions of devices for years, with the latest developments designed to make the malware more resilient and allow for multiple bad actors to take advantage of the system. Even though the company has terminated its business relationship with Videostrong, the open-source nature of Android means that it could continue using the operating system on its products.

There have been supply chain attacks in the past, wherein a third-party compromises a trusted product to steal data. Although Google did not characterize this as a supply chain attack, as it was perpetrated by the manufacturer itself and not a third-party operator, it still compromised a supposedly trusted operating system, leading to millions of victims.