Google has terminated its business relationship with Videostrong Technology Co., a certified Android TV partner, after discovering that the manufacturer installed an unauthorized backdoor into 1.3 million set-top boxes. According to a blog post from Google Cloud, the company purposefully embedded malicious software into its devices and sold access to criminal affiliates.
Monetizing the Backdoor
The investigation revealed that Videostrong did not merely overlook a security flaw but actively monetized the vulnerability. The manufacturer loaded malware modules from its affiliates onto the infected devices. These affiliates then used the compromised hardware to conduct ad fraud, build residential proxy networks, and remotely install additional malware on the end-user devices.
“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” Google stated in its report. The company noted that the malicious software was built directly into many different device models and brands over multiple years. This infrastructure was supported by dedicated systems and constantly evolving configurations designed to evade detection and manage the affiliate network.
Complex Malware Structure
While Google did not specify when the practice began, the company indicated that the pre-installed malware evolved into a complex, three-stage design in 2024. This evolution suggests that the manufacturer has been exploiting millions of devices for an extended period. The latest iterations of the malware were designed to be more resilient and allow multiple bad actors to utilize the system simultaneously.
Google concluded that this campaign was not the result of a rogue insider or a simple development oversight. The scale and sophistication of the operation pointed to a deliberate strategy by the manufacturer to exploit its position as a certified partner.
Consequences for Videostrong
As a result of these findings, Google has banned Videostrong from making devices with preloaded Google apps. This ban effectively removes the manufacturer’s ability to produce Android TV devices that include Google’s proprietary services. However, because Android is an open-source operating system, Videostrong may continue to use the base OS on its products, provided they do not include Google’s specific applications.
This incident highlights the risks inherent in the hardware supply chain. While Google did not characterize the event as a traditional supply chain attack involving a third-party operator, the manufacturer itself compromised the integrity of the trusted Android TV ecosystem. The breach affected millions of users who relied on these devices for their entertainment and connectivity.
The case serves as a reminder that even simple consumer electronics can be weaponized for sophisticated cybercriminal activities. The compromised set-top boxes were used to execute complex attacks, demonstrating the potential for widespread harm from seemingly innocuous hardware.
Source: Tom’s Hardware
