Google Bans Android TV Maker After 1.3 Million Devices Join Botnet

Google has banned device maker Videostrong from building certified Android products after its threat researchers linked the company to a backdoor that turned more than 1.3 million set-top boxes into a botnet. In a report published on 2 November, Google said it and industry partners had dismantled the XCPE operation the previous week. Its assessment is that the backdoor was intentionally developed and deployed for financial gain. That is Google’s finding, not a court determination.

The case is more troubling than an ordinary malicious app. Google says components were built into the firmware of different device models and brands over several years. Some code activated after first boot, exploiting a gap in checks used for certified Android devices. A customer could therefore buy a box that looked legitimate while the software inside quietly enrolled it in a network controlled by somebody else.

According to Google, Videostrong sold access to criminal affiliates that loaded additional malware modules onto affected boxes. The resulting activity included advertising fraud, use of household connections as residential proxies and the installation of further malicious software. Google also describes risks of data theft and malicious traffic passing through a victim’s internet connection. A television box may seem less sensitive than a phone, but it is still a computer connected to the home network.

Google says it took legal action against domains and servers used to control the botnet and against command infrastructure linked to more than a dozen secondary malware families. It estimates that disrupting those affiliates’ infrastructure could cut off access to at least 10 million additional compromised devices. That larger figure is an estimate of the affiliates’ wider reach, not a count of XCPE-infected set-top boxes.

The company has also barred Videostrong and future subsidiaries or affiliates from making or supplying software for certified Android devices. It says its firmware review process is being strengthened. The distinction between an Android-powered device and one certified to ship with Google’s apps matters here, because Google’s ban applies to the latter ecosystem.

The discovery exposes a weak point in the hardware supply chain. Retailers, white-label brands and telecoms can sell devices whose underlying firmware they did not design. A security check at the app-store level cannot fully protect users if the system image itself is compromised. Google says manufacturers and downstream sellers share responsibility for closing that gap.

For buyers, the practical lesson is to check who actually manufactured a streaming box, whether it has a credible update policy and whether it is genuinely certified rather than merely advertised as running Android. Those checks cannot guarantee safety, but they make opaque, unsupported devices a less attractive gamble. TechBooky has previously covered another Google disruption of a network that exploited consumer devices. The XCPE case adds a sharper warning: the threat can begin before a device is even switched on.