Hyderabad: Google has revealed that one of its Android partners secretly turned about 1.3 million set-top boxes into a botnet. The key point is that it was done on purpose. This means that Google's partner deliberately placed malware into people's devices.
Videostrong Technology built a backdoor into the products it made. Google has now broken that backdoor and ended its ties with the company. The company can no longer make certified Android devices or supply software.
It used a technique called obfuscation to hide the code. As a result, the malware loaded the first time a user switched on the device. This was not limited to one model. It was built into many brands and models over several years. Many Android TV set-top boxes were hit, along with telehealth devices, karaoke machines and digital signage screens.
What harm was done?
The malware infected users' devices and they were used for malicious purposes without their permission. These devices were used for ad fraud and data theft. They were also used to route unauthorised network traffic.
Videostrong made money by selling access to the backdoor. It sold entry to criminal groups and loaded their malware modules onto the devices. These modules carried out ad fraud, quietly linked devices to residential proxy networks and loaded more malware.
Google has also shut down the command-and-control domains of these partner modules, as they have other ways to spread their tools. At least 10 million more devices were cut off. Google has since changed its review process for device makers.
The case shows that even a partner of a major brand like Google can become a serious threat to users. People should take more care of the safety of their own devices. Still, Google acted in time and limited much of the damage.
How can users safeguard themselves?
Users cannot completely remove the malware themselves from their Android TV set-top boxes and smart streaming devices. This is because the XCPE backdoor is integrated directly into these devices' firmware. Tech experts recommend replacing infected devices. However, if a user cannot do so, they can take the following steps to secure the affected Android set-top box.
- Ensure that the Google Play Protect settings remain active, as this will help block unauthorised installations.
- Uninstall any app that offers money or rewards for sharing "unused internet".
- Carefully review app permissions in the device settings.
- Remove any app that you did not download.