Google announced the discovery and dismantling of a backdoor installed in 1.3 million devices manufactured by Shenzhen-based Videostrong Technology Co., an authorized Android partner. The company stated it has terminated its relationship with the manufacturer and banned it from building or selling certified Android devices or providing software for them.
According to Google, the compromised devices were deployed without user knowledge for unauthorized purposes including ad fraud, data exfiltration, and rerouting network traffic. The company characterized the backdoor and associated botnet as intentionally developed and operated for financial purposes. Google detailed that Videostrong monetized the installation by providing access to criminal affiliates who loaded additional malware modules onto the infected devices, enabling ad fraud schemes and enrollment of devices into residential proxy networks.
The affected hardware consisted primarily of Android TV set-top boxes, though the infection extended to other Android-based Internet of Things devices such as telehealth equipment, karaoke machines, and digital signage systems. The malware was embedded into multiple device models and brands across several years. Google indicated that Videostrong employed obfuscation techniques to load the malware during the initial device startup process, concealing the installation from users.
In response to the incident, Google reported disrupting command and control domains supporting the affiliate modules. The company assessed that this action would restrict access to approximately 10 million additional compromised devices beyond the initial 1.3 million affected units. Google also stated it implemented modifications to its review procedures for device manufacturers following the discovery.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI