Google links Videostrong to backdoor in 1.3 million TV boxes

Google’s Threat Intelligence Group (GTIG) says it has high confidence that Android device maker Videostrong Technology built and operated the x[.]cpe backdoor for financial gain, infecting 1.3 million certified Android TV boxes. Videostrong sold criminal affiliates access to the botnet, allowing them to install their own malware. The backdoor, also known as com[.]oemservice in some versions, was embedded in device firmware with system-level privileges.

If removed, it could reinstall itself after a reboot from the `/oem/` partition, and it could disable Google Play Protect’s app checks. Google says the malicious code was loaded after devices’ first boot, helping them pass compatibility and security testing.

The compromised boxes could route other people’s internet traffic through owners’ home IP addresses as part of residential proxy networks, as well as generate fake advertising views and clicks. Google observed operators capturing live screenshots, injecting keystrokes, collecting account and device information, and opening reverse shells. Affiliate modules could also load further malware. Proxy traffic could make an owner’s IP address appear connected to activity they had not initiated, such as attempts to guess account passwords.

Google and its partners took legal action to disrupt the domains and servers used to control the botnet. Google says it has barred Videostrong and its future subsidiaries and affiliates from making certified Android devices, and strengthened firmware integrity checks for certified Android TV devices. The action does not remove the backdoor from infected boxes, and Google has not published a complete list of affected models.

Owners who suspect their box is affected should disconnect it and contact the seller or manufacturer about clean firmware or a replacement; uninstalling the app will not remove the firmware backdoor.