Google has ended its relationship with TV box manufacturer Videostrong after finding that the company intentionally installed malware in its devices. According to the investigation, Videostrong evaded some of Google’s security requirements for certified original equipment manufacturers to add malicious code during manufacturing.
Google’s Threat Intelligence team disrupted XCPE, a backdoor that could infect Android devices and make them part of a botnet. Google estimates that more than 1.3 million devices were compromised. The malware had been distributed worldwide, including in Brazil.
Videostrong and its subsidiaries are no longer allowed to sell new devices with Android apps and platforms. A report from Synthient identified Mecool, a brand that sells projectors and TV boxes, as potentially affected, but a specific list of compromised models has not been published.
Because the malware is embedded in device firmware, resetting a TV box to factory settings would not remove it. Google says it has taken down the domains and servers used to spread malware through the botnet, preventing further devices from being exposed. The company also plans to review some of its security tests and requirements.
Sources: Canaltech.