When you buy a new streaming device, you probably worry about whether it supports Netflix, how quickly it loads apps, or whether the remote control feels cheap. What you probably don’t consider is whether the company that manufactured it deliberately installed malware before you ever opened the box.
According to Google, that’s exactly what happened to more than 1.3 million Android TV set-top boxes. Even worse, the manufacturer allegedly turned those devices into a source of revenue by giving cybercriminals access to hardware sitting inside people’s homes.
In a November 2 report, Google’s Threat Intelligence Group identified Videostrong Technology as the company responsible for developing and operating a malicious system called XCPE. Researchers say they have high confidence that the activity was intentional, rather than the result of a careless employee or an overlooked security problem.
Videostrong manufactures Android-based devices for different brands, meaning consumers might not even recognize the company’s name. Google found the malicious software embedded in numerous products over multiple years, with the overwhelming majority of infections involving television streaming boxes.
What makes this case especially disturbing is how the malware worked. Instead of tricking customers into downloading a suspicious application, the manufacturer allegedly placed a backdoor directly into the device’s firmware.
That gave the software system-level privileges and allowed it to contact remote servers for instructions. It could download additional applications without permission, execute commands, capture screenshots, and collect information from the infected hardware.
Google also observed operators stealing account information and system logs, injecting keystrokes, and establishing remote access to compromised devices. This was considerably more invasive than an unwanted application displaying advertisements.
The malware even had the ability to disable Google Play Protect, removing a security measure intended to help Android users avoid dangerous software. And because the original backdoor lived in the firmware, uninstalling its application wasn’t enough to eliminate it.
If someone managed to remove the installed component, the malicious service could simply reinstall it when the device restarted. A factory reset also shouldn’t be assumed to solve the problem when the underlying firmware remains compromised.
Your internet connection was part of the business
The attackers weren’t necessarily interested in what people watched on television. A major part of the operation involved converting infected devices into residential proxies, allowing outside parties to send internet traffic through the customer’s home connection.
That means activity originating from a criminal somewhere else could appear to websites and online services as though it came from an ordinary household. The customer might have no idea that the streaming box connected to the television was being used this way.
Other malicious components committed advertising fraud or installed additional software. According to Google, some devices ran several money-making modules simultaneously, squeezing whatever revenue they could from hardware that consumers had already purchased.
The XCPE botnet itself involved more than 1.3 million set-top boxes. However, Google’s response extended beyond that particular network.
By targeting infrastructure associated with over a dozen additional malware families, the company estimates its actions will cut off access to at least 10 million other compromised devices. Those devices are associated with the broader criminal ecosystem and should not be confused with the original XCPE infection count.
How did this get past Google?
Perhaps the most troubling part of the investigation concerns Google’s own security testing. Manufacturers seeking Android certification are supposed to meet compatibility and security requirements, but Videostrong allegedly found a way around those checks.
Google says the company used techniques that concealed the malicious functionality during testing, allowing it to load after the device’s first startup. In other words, the security evaluation didn’t necessarily see the same software behavior that customers experienced once their products were running.
This raises uncomfortable questions about how much consumers can trust hardware certification when the manufacturer itself might be acting maliciously. Security protections become much less reassuring when someone responsible for building the device can design software specifically to evade them.
Google has responded by cutting ties with Videostrong and banning it, along with future subsidiaries and affiliates, from producing certified Android devices or supplying software to other certified manufacturers. The company also says it has changed its firmware review procedures to address the weakness exposed by this investigation.
Working with Japan’s National Police Agency and several cybersecurity companies, Google pursued legal action against infrastructure used to control the infected devices and distribute additional malware.
However, disrupting remote servers doesn’t necessarily remove the original backdoor from every affected product. Google also acknowledges that the wider criminal marketplace can adapt by changing infrastructure and moving to different malicious software providers.
Should Android users be worried?
The findings don’t mean every Android television or streaming device is dangerous. The investigation concerns a specific manufacturer and its associated products, not Android hardware as a whole.
Nevertheless, consumers should be careful when purchasing inexpensive Android-based streaming boxes from unfamiliar brands. Google recommends choosing products from reputable manufacturers, checking that built-in security protections are enabled, and avoiding applications that offer money in exchange for sharing internet bandwidth.
There is also a broader concern here. If a product arrives with malicious firmware, the customer may have little practical ability to identify the problem, much less repair it without a trustworthy replacement from the manufacturer.
It’s bad enough when cybercriminals find vulnerabilities in products we already own. The possibility that a manufacturer deliberately created those vulnerabilities to earn money from its customers is considerably worse.
Google deserves credit for exposing the operation and working to dismantle its infrastructure, but the company also needs to explain how its certification process failed to catch the behavior earlier. Consumers shouldn’t have to wonder whether the little box connected to their television was designed to serve them or someone paying a criminal for access to their home network.
Support independent tech journalism
NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi.
Support NERDS.xyz
