Google has confirmed that it has cut ties with Videostrong, a manufacturer of certified Android TV boxes, after finding that the company had built a backdoor into multiple device models and brands over several years. Google says the access could be sold for malware distribution and was supported by infrastructure used to control the XCPE botnet and related malware modules.
The company has taken legal action to block the domains and servers associated with that infrastructure. It has also banned Videostrong and its subsidiaries from manufacturing certified Android devices or selling software to other certified vendors. Google said the malicious software was integrated directly into devices and supported by changing configurations designed to avoid detection and manage affiliates.
A list compiled by Synthient, as reported by The Hacker News, identifies potentially affected products, with a focus on the Mecool brand, which has produced several Android TV and Google TV boxes. Mecool has also reportedly been rumored to be shutting down.
Google acknowledged that the devices had been sold as certified Android products, creating an expectation of safety. According to the company, the operators used obfuscation techniques to exploit a gap in its testing process and load malicious code after a device’s first boot.
In response, Google says it is updating its review process to address this type of behavior. The company described a manufacturer intentionally infecting users with malware as an unacceptable breach of trust.
Google says that taking down the command-and-control domains will sever access to at least 10 million additional compromised devices. Although the shutdown should prevent the affected boxes from reaching the infrastructure used to spread the malware, owners may still wish to consider alternative devices.
Sources: 9to5Google.