Abstract:
Google recently disclosed a large-scale security incident affecting the Android TV ecosystem. An officially certified Android TV device manufacturer was found to have been pre-installing hidden backdoors in its products for a long time and selling access to third parties for the purpose of distributing malware. After the investigation was completed, Google announced that it would completely cut off cooperative relations with the companies involved and take legal action to shut down the relevant malicious network infrastructure.
According to information released by Google, the company involved is Videostrong, a manufacturer in Shenzhen, China. The company once produced officially certified Android TV set-top box products, but investigations found that it had implanted remote-controllable backdoors into multiple models and brands of devices, and built a complete server network to manage related devices and distribute malicious code.
Google stated that these malicious programs were not the private actions of individual employees, nor were they accidental incidents caused by development errors. Investigators found that this system has been operating continuously for many years and has specialized infrastructure and continuously updated evasion detection mechanisms to continuously manage downstream partners and malicious modules. Based on these investigation results, Google decided to terminate all cooperation with Videostrong and prohibit it and its affiliated companies from producing any certified Android devices pre-installed with Google applications in the future.
As a follow-up measure, Google has initiated legal action against the domain names and servers used to control the XCPE botnet and successfully cut off the relevant control links. At the same time, the company also prohibits Videostrong and its affiliates from providing software services to other certified Android device manufacturers in the future.
Security research shows that the impact of this incident far exceeds ordinary malware transmission cases. Unlike previous malicious programs that mainly appeared on fake Android devices, the products involved are Android TV devices certified by Google, which means that consumers generally believe that they have passed official security audits when purchasing them.
The investigation found that the attacker used a special strategy to bypass authentication detection. They pre-install hidden code on the device when it leaves the factory, but use obfuscation techniques to circumvent the testing process and wait until the user starts the device for the first time to download or activate the malicious module. This allows related products to successfully pass compatibility and safety tests and thus obtain certification qualifications.
Google admitted that this incident exposed loopholes in its certification system. The company said the vendors involved took advantage of blank spaces in the review process to delay loading malicious code onto user devices. To prevent similar situations from happening again, Google is upgrading its certification and review mechanisms to strengthen its ability to verify device firmware and subsequent software behavior.
According to statistics from security agencies, affected devices are mainly concentrated in the field of Android TV and Google TV set-top boxes, among which Mecool brand products are considered to be one of the key affected targets. In addition to TV boxes, the same malicious components were also found in some digital signage equipment, karaoke equipment and telemedicine terminals.
Google stated that after shutting down the relevant control servers, the attackers have lost the ability to remotely control a large number of devices. The company estimates that this operation not only affected the currently confirmed infected devices, but also cut off the communication channel between at least 10 million additional affected devices and the attackers, thereby preventing the spread of further malicious activities.
Investigations revealed that these backdoors could have been used to install additional malware, perform ad fraud, build proxy networks, and conduct other cybercriminal activities. Due to its high system privileges, the infected device may be included in a large botnet system and provide network resources to attackers without the user's knowledge.
Google emphasized that allowing device manufacturers to knowingly sell products to users with malicious backdoors is a serious betrayal of consumer trust. Although the control server has been shut down and the current risk to the affected equipment has been greatly reduced, for users of related products, it is still a safer choice to evaluate the source of the equipment and consider replacing it with a more reputable brand product.
This incident has also become one of the most serious supply chain security incidents in the development of the Android TV platform. Because the equipment involved had received official certification, it not only raised concerns about the security of the smart TV hardware supply chain, but also prompted Google to re-examine its certification system and further strengthen its supervision of equipment manufacturers.
Comments