Google shuts down a sneaky malware backdoor on millions of Android TV and Google TV boxes

What happened

Google has confirmed that an Android TV device maker snuck a backdoor (a hidden way into a system that bypasses its login) for malware (software written to damage a system or steal from it) onto certified devices, which is leading to security improvements for the ecosystem as a whole. In a post today, Google confirmed that it has cut ties with “Videostrong,” a company that was manufacturing certified Android TV boxes. Google is a software and Internet company based in Mountain View, and its products and services include Software tools.

This is due to the company building in a backdoor that it could sell access to, including the distribution of malware. Google has taken legal action to block the domains and servers that “Videostrong” was using to control the XCPE botnet and malware modules and banned the company and its subsidiaries from selling certified Android devices going forward, or selling software to any other certified vendors.

As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps. Mecool has been rumored to be shutting down.

Synthient (via The Hacker News ) compiled a list of potentially affected devices, with the focus being on the Mecool brand that has made some well-known Android TV and Google TV boxes in the past.

With that in mind, Google is updating its review process to protect users against this type of behavior, and Google reiterates that “a device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust.” Google’s shutdown of the domains and servers used to spread malware should leave affected Android TV and Google TV boxes safe to use – the company says that “taking down their C2 domains will sever access to at least 10 million additional compromised devices” – but owners may still want to consider alternate options.