Google says one of its Android manufacturing partners built a backdoor into 1.3 million devices, first reported by The Verge. The infected devices were used without owners’ knowledge for ad fraud, data exfiltration and routing unauthorized network traffic, while Google says it has dismantled the backdoor and cut ties with the manufacturer.
Videostrong Technology Co., based in Shenzhen, China, has been banned from building or selling certified Android devices or supplying software for them.
Most affected devices were Android TV set-top boxes, but the malware was found built directly into many device models and brands over multiple years. The affected mix also included Android-based IoT devices such as telehealth devices, karaoke machines and digital signage devices.
Google says Videostrong monetized the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices. Those modules conducted ad fraud, silently enrolled infected devices in residential proxy networks and loaded additional malware onto XCPE-compromised devices.
Google described the backdoor and botnet as intentionally developed, deployed and operated for financial gain. It also says Videostrong used obfuscation techniques to load malware onto users’ devices after they booted up the hardware for the first time.
The incident spans malware embedded in multiple hardware categories and affiliate modules operating through command-and-control domains.
Google says it took action to disrupt the command-and-control (C2) domains that operate the affiliate modules. Google also says it changed its review process for device manufacturers after the incident.
Google assesses that taking down those domains will sever access to at least 10 million additional compromised devices because the affiliates have diversified distribution channels for their modules beyond XCPE.