Google Cuts Off Backdoor in Certified Android TV Boxes

Google has confirmed that Videostrong, a maker of certified Android TV devices, built a backdoor into its products that allowed malware to be distributed to them. According to Google, the company was in a position to sell that access, and the access covered the delivery of malicious software. Google said it has cut all ties with Videostrong.

Google says the malware was embedded directly in many different device models and brands over a period of years. The company does not believe the campaign was an isolated insider incident or a development oversight. By Google's figures, the number of affected devices runs into the millions.

What Google has done

Google took legal action to block the domains and servers Videostrong used to run its XCPE botnet and manage the malicious modules. It also barred Videostrong and its affiliates from selling certified Android devices, and from selling software to other certified manufacturers. Videostrong is further prevented from making devices that ship with Google apps preinstalled.

According to Google's findings, the malware was not tied to a single model. It was built into many devices and brands, backed by dedicated infrastructure, and used constantly changing configurations to evade detection and manage affiliates. Google's view is that this was not the work of one person or the result of a mistake.

Affected devices and the Mecool link

A third party has compiled a list of devices that may have been affected. The list centers on Mecool, a brand that has made well-known Android TV and Google TV boxes in the past. There are also rumors that Mecool may be shutting down.

Google says that taking down the command-and-control domains will cut off access to at least 10 million additional compromised devices. After this step, affected Android TV and Google TV boxes should be safe to use. Even so, owners may be wise to consider alternative products.

The gap in certification

Google also acknowledges, to a degree, that the problem stemmed partly from a shortcoming in its own process. Because these devices were sold as certified Android devices, users could reasonably assume they were safe. According to the company, the bad actors used obfuscation techniques to exploit a gap in testing and loaded the malicious code only after the device's first boot.

Google is now updating its review process to protect users against this kind of behavior. The company stressed that a device maker knowingly infecting its own customers with malware is an unacceptable breach of trust. The episode is also a reminder that a certification label alone should not be treated as a guarantee of security.