Google has permanently banned a Chinese manufacturer from its Android partner program after discovering that the company intentionally turned 1.3 million devices into a botnet. The Shenzhen-based Videostrong Technology Co. is now prohibited from building or selling certified Android devices or supplying software for them, according to the company.
Google stated that Videostrong secretly built a backdoor into its hardware. This malware allowed the manufacturer to hijack devices without owners’ knowledge. The infected hardware was then used for malicious activity, including ad fraud, data exfiltration, and routing unauthorized network traffic.
Financial Motive and Criminal Affiliates
The company claims the backdoor and resulting botnet were developed and operated specifically for financial gain. Videostrong monetized the infrastructure by selling access to criminal affiliates. These affiliates then loaded their own malware modules onto the compromised devices.
These secondary modules performed several harmful tasks. They conducted ad fraud, silently enrolled infected devices into residential proxy networks, and loaded additional malware onto other compromised devices. Google also disrupted the command and control domains that operated these affiliate modules.
Google assessed that taking down these domains would sever access to at least 10 million additional compromised devices. The company noted that these affiliates used diversified distribution channels for their modules beyond the specific devices involved in this case.
Widespread Infection Across Device Types
The scope of the infection extended far beyond a single product line. The malware was built directly into many different device models and brands over multiple years. While most of the affected hardware consisted of Android TV set-top boxes, the botnet also infected other Android-based IoT devices.
These additional devices included telehealth equipment, karaoke machines, and digital signage units. Google said Videostrong used obfuscation techniques to load the malware onto users’ devices after they booted up the hardware for the first time.
Google has now dismantled the backdoor and cut ties with the manufacturer. The company also stated that it made changes to its review process for device manufacturers following this incident. The ban ensures Videostrong can no longer participate in the certified Android ecosystem.
Source: The Verge
