Backdoor found in 1.3 million Android TV boxes used by criminals

Google's Threat Intelligence Group says Android device maker Videostrong Technology built a hidden backdoor into about 1.3 million certified Android TV boxes and sold access to criminals. A backdoor is secret software that lets someone control a device without the owner knowing. Criminals then loaded their own malicious add-ons onto the boxes.

The backdoor lives in the firmware, the built-in software that runs the device, with full system privileges. If it is uninstalled, it puts itself back when the box restarts. It could also turn off Google Play Protect app checks so more software could be installed silently. Google says the malicious code was loaded after the first startup, which helped it pass Google's certification tests.

Infected boxes were used to route other people's internet traffic through their owners' connections, generate fake ad clicks, take screenshots, type keystrokes remotely, collect account and device details, and install more malware. That means your internet address could be tied to activity you never started, such as attempts to guess other people's passwords.

Google and partners took down the servers controlling the network and banned Videostrong from making certified Android devices. However, the backdoor is still inside infected boxes and could be used again by other criminals. Google has not published a full list of affected models, so the model name alone may not tell you if a box is affected.

Many offices use inexpensive streaming boxes for waiting room TVs or break rooms. If one of these sits on the same network as your computers, it could put more than just the TV at risk.