Google severs ties with and bans Android TV box maker Videostrong after discovering it intentionally preloaded a malware backdoor to control the XCPE botnet

Your Android TV box may have been secretly compromised, and its security will now be improved without any action from you.

Google has severed ties with and banned Android TV box maker Videostrong after discovering the company intentionally preloaded a malware backdoor into its devices. This backdoor was designed to control the XCPE botnet and distribute malware, affecting millions of devices across multiple brands. Videostrong allegedly used obfuscation techniques to bypass Google's certification tests, loading malicious code after the device's initial boot. Google has taken legal action to block the command-and-control domains and servers used by Videostrong, and has banned the company from producing certified Android devices or selling software to other certified vendors. The company estimates that takedown efforts have severed access to at least 10 million compromised devices.

This incident reveals a significant vulnerability in the Android TV certification process, allowing manufacturers to intentionally compromise user devices with malware that evades detection. Google's admission of a "gap in our tests" highlights the need for more robust security vetting of third-party hardware. The company's swift action to block infrastructure and ban Videostrong demonstrates a commitment to addressing such breaches, but the multi-year nature of the scheme suggests that such compromises may be more widespread than initially identified.

The fallout for Videostrong, including a ban from producing certified devices and potential shutdown of its Mecool brand, serves as a stark warning to other hardware manufacturers. Google's update to its review process implies a future where device security will be a more rigorous part of certification, potentially leading to longer lead times for new Android TV devices but increased user trust. Users affected by the malware will see their devices become safer, though Google advises considering alternative options as a precaution.