Your Streaming Box Let Strangers Use Your Internet, Google Says

Google says an Android manufacturing partner secretly built a backdoor into 1.3 million devices, mostly TV boxes, turning equipment in owners' homes into a network available to criminal affiliates. ^[1]

The company says it has ended its relationship with Shenzhen-based Videostrong Technology and barred it from making or selling certified Android devices or supplying software for them. It also says it disrupted the backdoor and online infrastructure used to direct malicious software on infected equipment. ^[1]

The allegations, attributed to Google in a November 2 account published by The Verge, describe a breach originating with a manufacturer inside Google's certified Android ecosystem. Google says the software was embedded across multiple models and brands over several years. ^[1]

That puts the scrutiny on the checks between a manufacturer and the customers who buy its products. If Google's account is accurate, owners received devices whose maker had already arranged a route for unauthorized access. Downloading a suspicious app was not a necessary first step.

Google says it has changed how it reviews device manufacturers following the incident. Without details of those changes, buyers cannot judge what additional protection the review now provides. ^[1]

The allegations and the claimed disruption have not been independently confirmed. We have not found a direct Google statement, technical evidence, an affected-device list or a response from Videostrong. ^[1]

A backdoor built into the product

A backdoor is a concealed way into a device that bypasses its ordinary access controls. Google says Videostrong used techniques designed to hide the malware and load it after devices first started up. It says most affected products were Android TV boxes, which connect televisions to internet services. ^[1]

The alleged reach extended beyond the living room. Google also identified Android-based telehealth devices, karaoke machines and digital signs among the affected equipment. It says the malware appeared in products sold under multiple brands, making the manufacturer, rather than a single consumer-facing name, the common link. ^[1]

Google says Videostrong sold criminal affiliates access to the backdoor and installed their malicious software modules on compromised devices. Those modules gave different operators a way to use the same underlying access for their own activities. ^[1]

According to Google, the devices were used without their owners' knowledge for advertising fraud, extracting data and carrying unauthorized internet traffic. Affiliate software also loaded further malware. ^[1]

This describes a business built around continuing access to equipment after its sale. The alleged backdoor supplied the entry point, while additional software supplied the uses. A buyer could own the box without controlling everything it did.

One use Google identified was enrolling devices in residential proxy networks. These route someone else's internet traffic through a device's connection. In this case, Google says, the owners had not authorized that use. ^[1]

The connection itself therefore became part of what affiliates could exploit. The allegation reaches beyond unwanted software sitting on a box, to strangers using an owner's internet access as a service.

Two numbers, two different claims

Google's account contains a second, much larger figure: it estimates that disrupting the systems directing the affiliate malware will sever access to at least 10 million additional compromised devices. Those systems are known as command-and-control infrastructure, the online destinations through which operators send instructions to malware. ^[1]

That estimate describes a wider network than the 1.3 million devices Google attributes to Videostrong's backdoor. Google has not attributed those additional devices to Videostrong. Its estimate concerns the reach of the affiliate infrastructure it says it disrupted. ^[1]

The distinction matters for judging the operation's scale. The smaller number concerns the alleged manufacturer-installed access. The larger number is Google's assessment of what disabling shared infrastructure will accomplish. They measure different parts of the operation and should not be combined into a single Videostrong infection count.

Cutting a control channel can interrupt an operation. It does not, by itself, tell a device owner whether the underlying software has been removed. A network-level disruption and a clean device are different outcomes.

Certification faces a harder test

The manufacturer-review changes deserve equal attention. Google's account places the alleged source of the malware inside a supplier relationship, where checks must address what a company builds into its products and how that software behaves after startup. ^[1]

Our view is that Google owes buyers an explanation of those checks alongside its account of the takedown. Certification asks customers to place trust in a system they cannot inspect themselves. When Google says a participant abused that position over several years, removing that participant is only part of the answer.

The next useful disclosure would connect the security operation to the equipment people actually own: affected models and software versions, a way to identify compromised devices, and instructions for dealing with them. Google has offered a large disruption figure. Owners need a device-level answer.