Insights Security & Privacy
Android TV boxes found with built-in malware: what to check
The short version
Google and its partners dismantled a network that used 1.3 million Android TV boxes for crime. Google says the maker, Videostrong, put the malware in at the factory. The takedown does not clean the boxes themselves, so owners still need to act.
What happened
Google says Videostrong Technology Co. built a hidden backdoor into the software of its devices, across many models and brands over several years. It sold access to other criminals, who used the boxes for ad fraud and to route strangers' internet traffic through them. Operators could also capture screens and collect account details.
The backdoor could switch off Google Play Protect, Android's built-in app safety check. Google has banned Videostrong from making certified Android devices. It also took down servers linked to at least 10 million more infected devices, including karaoke machines and telehealth hardware.
BleepingComputer reports the malware is still on infected boxes and reinstalls itself if deleted.
Why it matters to you
The malware came with the box, so careful use would not have prevented it. A box on your home or office network can leak account details and let others use your internet connection without your knowledge.
With the control servers gone, the criminals may have lost their hold. But the code remains on the device, and a box that can see your screen is a poor place to sign in to banking or work accounts.
What to do
Check who made your box. Videostrong's software was found across many models and brands, so the brand name alone may not clear it.
If you cannot confirm it is clean, stop using it for sensitive logins. Disconnect it from the internet, or ask the seller or maker for clean firmware.
Sources
- Shutting the Door on the XCPE Botnet Google Cloud Threat Intelligence blog (primary source) (opens in a new tab)
- Google disrupts million-device XCPE Android malware botnet, bans TV box maker BleepingComputer (opens in a new tab)
- One of Google's Android partners turned 1.3 million set-top boxes into a botnet The Verge (opens in a new tab)
- Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access The Hacker News (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.