Android Security: Videostrong Botnet Compromised 1.3 Million Devices

Millions of Android users faced hidden risks from their set-top boxes, telehealth monitors, and karaoke machines. Google disclosed that a manufacturing partner installed secret software on 1.3 million devices without owner permission. This covert operation allowed unauthorized actors to use consumer hardware for commercial gain.

The manufacturer, Videostrong Technology Co., based in Shenzhen, China, is now barred from producing or selling certified Android hardware. Google states the company intentionally built the backdoor into the devices. The firm sold access to the compromised network to criminal affiliates. These partners used the devices for ad fraud, data exfiltration, and routing network traffic.

The malware was embedded directly into various device models and brands over several years. Most affected units were Android TV set-top boxes, but the network also included Android-based IoT equipment. Google used obfuscation techniques to load the software after devices first powered on. The company has since dismantled the backdoor.

Google disrupted the command and control domains that managed the affiliate malware modules. The company assesses this action will cut off access to at least 10 million other compromised devices. These affiliates have diverse distribution channels beyond the Videostrong hardware. Google has also adjusted its review process for device manufacturers following this incident.