Google Bans Videostrong Over Android TV Box Malware

Google shuts down XCPE botnet

Google banned Videostrong Technology, a Shenzhen company, for intentionally creating a botnet that infected 1.3 million Android TV boxes with backdoors for criminal use.

“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users”

Videostrong's malware operations

Videostrong loaded criminal modules onto boxes to create residential proxies and fake ad views, and stole user data through backdoors.

Google's takedown actions

Google worked with international partners to take down Videostrong's servers and over a dozen malware families, cutting off 10 million infected devices.

Infected device distribution

TrendAI counted 1,472,554 infected devices across 206 models between June and October, with the US, Germany, UK, Australia and Canada each having 26,000 to 42,000 devices.

Videostrong's certification gap

Videostrong was a certified Android maker that hid its malware code to exploit a gap in Google’s security tests, loading it after a device’s first boot.

“a gap in our tests”

Remaining infected devices

Owners cannot remove the backdoor themselves as it runs as a system app signed with the maker’s key, leaving 182 model names infected.