Google claims one of its Android manufacturing partners secretly built a backdoor on 1.3 million devices and turned them into a botnet. The company says it has now dismantled the backdoor and “cut ties” with the manufacturer, Shenzhen, China-based Videostrong Technology Co., which has been banned from building or selling certified Android devices or providing software for them.
The infected devices were used without the owners’ knowledge for “malicious activities”, such as ad fraud, data exfiltration and routing of unauthorized network traffic. Google claims that “the backdoor and botnet were intentionally developed, deployed, and operated for profit,” stating:
Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malicious modules onto infected devices. These secondary modules carried out ad fraud; silently enroll infected devices into residential proxy networks; and loading additional malware onto devices compromised by XCPE. We have also taken steps to disrupt the command and control (C2) domains that operate these affiliated modules. Given that these affiliates each have diverse distribution channels for their modules beyond XCPE, we estimate that removing their C2 domains will cut off access to at least 10 million additional compromised devices.
It wasn’t just one device that was affected: the malware was found “embedded directly into many different models and brands of devices over several years.” Most of them were Android TV set-top boxes, but the botnet also infected other “Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices.”
Google claims that Videostrong used “obfuscation techniques” to load the malware onto users’ devices after the hardware was first booted. Google also says it changed its review process for device makers after this incident.
Gn tech
