Google severs ties with and bans Android TV box maker Videostrong after finding it intentionally preloaded malware to open a backdoor to control the XCPE botnet

If you own an Android TV or Google TV box, malware has been removed from your device.

Google has severed ties with and banned Android TV box maker Videostrong after discovering the company intentionally preloaded malware on its certified devices. This malware created a backdoor to control the XCPE botnet, affecting millions of devices. Videostrong allegedly sold access to this backdoor for malware distribution. Google has taken legal action to shut down the command-and-control domains and servers used by Videostrong, effectively disabling the botnet and malware modules. The company and its subsidiaries are now banned from selling certified Android devices or software to other vendors. Google stated that the malicious code was hidden through obfuscation techniques, exploiting a gap in their testing process and loading after the device's first boot. This incident has prompted Google to update its review process to prevent similar breaches of trust in the future.

The discovery and shutdown of the XCPE botnet highlights a significant vulnerability in the certification process for Android TV devices, indicating that sophisticated malicious actors can bypass security checks. Google's admission of a gap in their testing and subsequent promise to update their review process suggest a more robust vetting system is now in place for device manufacturers. This breach of trust could lead to increased scrutiny of "certified" Android devices by consumers and potentially stricter requirements from Google for device makers. The incident also points to the evolving tactics of botnet operators, who are embedding malware directly into hardware at the manufacturing level.

The severing of ties with Videostrong and their ban from selling certified devices signals a zero-tolerance policy from Google towards manufacturers who deliberately compromise user security. This action may serve as a deterrent to other potential bad actors in the Android TV ecosystem and could encourage other hardware manufacturers to implement more rigorous internal security audits. Consumers may see a renewed confidence in "certified" Android TV devices over time, but initially, awareness of this type of hardware-level malware could lead to caution when purchasing new devices. The ongoing battle against botnets like XCPE underscores the persistent threat landscape in the connected device market.