Android TV manufacturer used millions of devices to build a botnet

Google has identified that a manufacturing partner, Shenzhen-based Videostrong Technology Co., intentionally embedded a backdoor into 1.3 million Android TV boxes to create a massive botnet. This security breach, involving the XCPE backdoor, allowed criminal affiliates to use consumer devices for unauthorized activities across more than 200 countries. A collaborative effort involving Japan's National Police Agency and several private security firms, including Human Security and TrendAI, successfully disrupted the operation. Google has since severed all professional connections with the manufacturer and banned the company from producing or providing software for certified Android hardware.

The exploitation of these devices enabled malicious tasks such as data exfiltration, ad fraud, and the routing of unauthorized network traffic through unsuspecting users' internet connections. By selling access to the firmware-level backdoor, Videostrong allowed criminals to establish proxy networks to mask illegal activity. To mitigate risks, businesses must immediately verify if their hardware is compromised, apply necessary security patches, and implement measures to safeguard sensitive data and critical systems.