Google says one of its Android manufacturing partners intentionally embedded a backdoor in 1.3 million devices and operated them as a botnet for financial gain.
The company identified the partner as Videostrong Technology Co., a manufacturer based in Shenzhen, China. Google says it has dismantled the backdoor, disrupted command-and-control domains linked to the operation and ended its relationship with the company. Videostrong has also been banned from building or selling certified Android devices or supplying software for them.
According to Google, infected devices were used without their owners’ knowledge for activities including ad fraud, data exfiltration and the routing of unauthorized network traffic. The company says Videostrong sold access to the backdoor to criminal affiliates, which installed additional malware modules on compromised devices.
Those modules reportedly enrolled devices in residential proxy networks, carried out advertising fraud and delivered further malware. Google says disrupting the affiliates’ command-and-control domains could cut access to at least 10 million additional compromised devices, although those affiliates also used other distribution channels.
The malware was not limited to a single product. Google says it had been built directly into multiple device models and brands over several years. Most of the affected hardware consisted of Android TV set-top boxes, but other Android-based IoT products were also involved, including telehealth devices, karaoke machines and digital signage systems.
Google says Videostrong used obfuscation techniques to load the malware after users powered on the hardware for the first time. Following the incident, the company also made changes to its review process for Android device manufacturers.