Google dismantles botnet of over 1.3 million Android TV boxes linked to Shenzhen maker
Owners cannot remove the firmware backdoor themselves, so security firms advise replacing affected boxes.
Google and partners, including Japan's National Police Agency, took down command-and-control infrastructure for a botnet of more than 1.3 million mostly Android TV set-top boxes, which lost control of its servers in late October. Google says it has high confidence that Shenzhen-based Videostrong built a backdoor into its devices and sold access to criminal affiliates, a claim it bases on code and infrastructure links rather than a rogue insider. The takedown also cut off at least 10 million more infected devices, including karaoke machines and telehealth hardware, and Google has revoked Videostrong's Android licensing and banned it from making certified devices. Because the backdoor is embedded in firmware and reinstalls after restarts, owners cannot remove it themselves, and security firms advise replacing affected boxes.
Why it matters
The case shows that a device can be compromised before it reaches a buyer, since the backdoor was built into firmware during manufacturing rather than spread through software flaws. For people who own these inexpensive streaming boxes, the infection persists through restarts and cannot be cleared by the owner, so the practical step is replacement. The takedown also reached at least 10 million more devices infected by other means, and Google's revocation of the maker's Android licence means its future devices will no longer carry Google apps.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.