Google disrupts Android botnet linked to Videostrong devices

Technology · First reported 2 Nov, 15:50 · Updated 16:58

Image: Wikimedia Commons · NASA Johnson Space Center · Public domain

Google says it took down the servers controlling a botnet that affected more than 1.3 million Android devices, mostly TV boxes. It attributes the built-in backdoor to device maker Videostrong, has ended its relationship with the company, and says the backdoor remains on affected devices.

Google says the botnet affected more than 1.3 million Android devices, mostly TV set-top boxes, and that it took down the servers controlling them in late October.
Google says Videostrong intentionally installed the x.cpe backdoor in devices and sold criminal access; the company has denied no claims in the supplied coverage.
The backdoor gave operators system-level access, which Google says was used to install apps, capture screens and gather device or account information.
Google says it cut ties with Videostrong and barred it and future affiliates from making or selling certified Android devices or supplying software to certified device makers.
The backdoor is embedded in firmware and can reinstall after a restart; the report says owners cannot remove it themselves.

Summary written by Lux AI from 3 articles

Key facts

Affected devices: More than 1.3 million, mostly Android TV set-top boxes.
Backdoor: x.cpe, embedded in device firmware.
Takedown timing: Late October.
Videostrong location: Shenzhen, China.
Google's response: It took down control domains and servers and ended its relationship with Videostrong.