Google says one Android partner planted malware on 1.3 million devices to spy on users

Google has revealed that one of its Android partners had hidden malware inside more than 1.3 million Android-based devices. According to the company, Shenzhen-based manufacturer Videostrong Technology intentionally did this primarily on Android-based TV set-top boxes. This allowed the company to give “criminal affiliates” access to users’ internet connection without their knowledge.“We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology,” the company said in a blog post. As per Google, the campaign was not the work of an isolated employee or the result of a development error. It has since banned Videostrong Technology from building or selling certified Android devices or supplying software for them.Videostrong Technology is an Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). It developed products for clients as well as its own line-up. As an Android partner, the company had an agreement with Google to develop certified Android devices.Videostrong Technology was founded in 2011. According to its website, its products serve over 100 million households in more than 60 countries. What was the malware?In the blog post, Google said this backdoor allowed for the creation of a botnet. In simple terms, a botnet is a network of infected devices that a hacker can access after planting malware. The infected devices were then used for ad fraud, data theft, routing unauthorised traffic through internet connections and installing additional malware. All of this could happen while a user remained unaware.Most infected devices were Android TV set-top boxes. However, the malware was also found on telehealth devices, karaoke machines and digital signage systems. The campaign affected devices across more than 200 countries and involved several models and brands over multiple years. Though Google did not name any products in particular. Google has stated that it worked with partners to dismantle this botnet. That is, while the company has not named which devices were affected, the malware itself is likely no longer operational. This means that your device is likely not part of such a botnet, even if it was affected. But we will need more information from Google to understand which were actually impacted.The company has also taken legal action to shut down the domains and servers controlling the botnet.The backdoor, known as x.cpe, was embedded in the device from the factory itself. After you booted the device for the first time, it gained system-level access. From that point, this malware could install applications silently, run commands, capture screens, and collect account details as well as device information. It could also turn infected devices into residential proxies, allowing other people’s internet traffic to pass through owners’ home connections.“Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors,” Google said. “This led to a variety of malicious activities being conducted on and through the devices.”Google has changed its review process and is improving checks intended to verify the integrity of firmware on certified Android TV devices.The operation was carried out with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Besides disabling Videostrong’s infrastructure, the partners disrupted command-and-control domains used by more than a dozen malware families. Google estimates that this will cut criminal access to at least 10 million additional compromised devices distributed through channels outside XCPE.“Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach,” said Charley Snyder, head of disruption operations at Google Threat Intelligence Group. Google has also advised consumers of buying connected devices, such as set-top boxes, “from reputable manufacturers.”There have been similar cases in the past. Last year, German authorities blocked a similar botnet, called BadBox, that may have impacted millions of Android-based devices. Another botnet, called Vo1d, reportedly infected about 1.6 million Android TVs.- Ends