Google has confirmed that an Android TV device maker snuck a backdoor for malware onto certified devices, which is leading to security improvements for the ecosystem as a whole.
In a post today, Google confirmed that it has cut ties with “Videostrong,” a company that was manufacturing certified Android TV boxes. This is due to the company building in a backdoor that it could sell access to, including the distribution of malware. Google has taken legal action to block the domains and servers that “Videostrong” was using to control the XCPE botnet and malware modules and banned the company and its subsidiaries from selling certified Android devices going forward, or selling software to any other certified vendors.
We found this malicious software <a href="https://myappsplus.com/customs-ai-that-ignores-the-operator-is-built-to-fail/” title=”Customs AI That Ignores the Operator is Built to Fail”>built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates. We believe this campaign wasn’t an isolated rogue insider or a development oversight. As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps.
Synthient compiled a list of potentially affected devices, with the focus being on the Mecool brand that has made some well-known Android TV and Google TV boxes in the past. Mecool has been rumored to be shutting down
Google somewhat admits that this was a failing on its part, as these devices were sold as “certified” Android devices with the implication that they were safe. The company explains that these bad actors “employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot.” With that in mind, Google is updating its review process to protect users against this type of behavior, and Google reiterates that “a device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust.”
Google’s shutdown of the domains and servers used to spread malware should leave affected Android TV and Google TV boxes safe to use – the company says that “taking down their C2 domains will sever access to at least 10 million additional compromised devices” – but owners may still want to consider alternate options.
More on Google TV:
- YouTube for Google TV update gives YouTube Music a distracting red logo
- Google TV powers the RayNeo Pocket TV Pro glasses, and that’s exactly the problem
- Google TV shows off its ‘new’ features in fullscreen roundup when you turn on your TV [Gallery]
Best Google TV devices:
Follow Ben: Twitter/X, Threads, Bluesky, and Instagram
You’re reading 9to5Google — experts who break news about Google and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Google on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel
