Google says one of its Android manufacturing partners secretly built a backdoor into 1.3 million devices and turned them into a botnet. The company says it has now dismantled the backdoor and “cut ties” with the manufacturer, Shenzhen, China-based Videostrong Technology Co., which has been banned from making or selling certified Android devices or supplying them with software.
The infected devices were used without the owners’ knowledge for “malicious activities” such as ad fraud, data leaks, and routing of unauthorized network traffic. Google claims that “the backdoor and botnet were intentionally developed, implemented, and operated for financial gain,” saying:
Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices. These secondary modules carried out advertising fraud; silently enroll infected devices in residential proxy networks; and load additional malware onto XCPE-compromised devices. We also took action to disrupt the command and control (C2) domains that operate these affiliated modules. Because each of these affiliates has diversified distribution channels for their modules beyond XCPE, we assess that removing their C2 domains will cut off access to at least 10 million additional compromised devices.
It wasn’t just one device that was affected, either: the malware was found “embedded directly into many different device models and brands over several years.” Most of them were Android TV set-top boxes, but the botnet also infected other “Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices.”
Google says Videostrong used “obfuscation techniques” to load the malware onto users’ devices after they first booted the hardware. Google also says it made changes to its review process for device manufacturers after this incident.
