Some Google-certified Android TV boxes were sold with malware preinstalled for years specifically, the XCPE backdoor and Google has revoked the manufacturer’s certification after discovering the problem.
A recent report has revealed that some Google-certified Android TV boxes included hidden malware pre-installed. This shows that Google’s certification did not provide a 100% guarantee that these devices were free of malicious software. Researchers found that approximately 1.3 million devices were affected and were part of a network used to generate financial gain through fraudulent online activities, such as various forms of monetization.
According to Google, the manufacturer, Technology, had deliberately introduced this hidden software. Furthermore, Videostrong allowed third parties to use the infected devices to display fraudulent ads, act as intermediaries for internet traffic, and carry out other similar activities. Google has blocked the infrastructure that controlled these infections and has revoked the manufacturer’s trust status, meaning it will no longer be able to sell devices with official Google apps preinstalled or obtain new certifications.
The problem was difficult to detect because the malicious software remained hidden during initial testing and only activated after the device was turned on for the first time. Google says it has modified its review processes to prevent this from happening again. For affected users, the situation is more complicated because the malicious software is embedded in the device’s operating system itself. If you have a Videostrong TV box or one from a partner brand such as MECOOL, there’s a chance it’s infected; check the list of potentially affected Android TV boxes HERE.
