Google cuts ties with Chinese partner after 1.3 million Android devices become a botnet

A Shenzhen-based hardware maker turned 1.3 million Android devices into a hidden network of compromised machines. Google identified the culprit as Videostrong Technology Co., a partner that built Android-based hardware for years. The company stated that Videostrong intentionally created the backdoor to generate revenue.

The infected hardware included Android TV set-top boxes, telehealth devices, karaoke machines, and digital signage units. Google found the malware built directly into many different device models and brands over several years. The company reported that the devices were used without owners' knowledge for malicious activity. This included ad fraud, data exfiltration, and routing unauthorized network traffic.

Videostrong monetized the system by selling access to criminal affiliates. These affiliates loaded their own malware modules onto the infected devices. The secondary modules conducted ad fraud and enrolled the devices into residential proxy networks. Google disrupted the command and control domains that managed these affiliate modules. The company assessed that shutting down these domains will sever access to at least 10 million additional compromised devices.

Videostrong used obfuscation techniques to load the malware onto users' devices. The software activated after the hardware booted up for the first time. Google has now dismantled the backdoor and cut ties with the manufacturer. Videostrong is banned from building or selling certified Android devices. It is also barred from supplying software for them.

Google stated that it made changes to its review process for device manufacturers following this incident. The company said the backdoor and botnet were developed and operated for financial gain. The infected devices were part of a larger network that extended beyond the initial 1.3 million units.