Google says a maker pre-loaded a backdoor on more than 1.3 million Android TV boxes, and a factory reset may not remove it.
Some cheap Android TV boxes came with malware built in, before the owner ever turned them on. Google says it disrupted a network of more than 1.3 million infected boxes and that the Chinese maker Videostrong Technology put the backdoor there on purpose.
Google's Threat Intelligence Group took action against a network called XCPE. It was made up of compromised Android TV streaming boxes. Google says it has high confidence that Videostrong designed, deployed and ran the backdoor itself, and that this was not the work of one rogue engineer.
Owners did not have to do anything wrong. No suspicious app, no bad website. The malicious code was already part of the box.
Google also says Videostrong sold access to the infected boxes to other criminal groups. Those groups used them for ad fraud, meaning fake views and clicks on online ads that bring in money. They also used the boxes as proxies, which means sending their internet traffic through the owner's home connection so it looks like it comes from an ordinary household.
Google says the backdoor let criminals install software remotely and switch off Google Play Protect, Android's built-in security check. Depending on the box, they could also:
Not every box was necessarily used for all of this. But it shows how much access the criminals had on a device sitting on your home Wi-Fi.
A factory reset normally wipes a device clean. Here, the backdoor was part of the box's firmware, the core software that runs it. Google says the malware could bring its components back after a reboot. Getting rid of it would mean replacing the firmware with a verified clean version, and that only works if one is available from a source you can trust.
Some of the affected boxes were Google-certified. Google says Videostrong hid the code during testing by making it load only after the first boot. Google says it is improving its review process. It has also banned Videostrong and its affiliates from making Google-certified Android devices or supplying software to certified manufacturers. Google says the malware dates back to at least late 2021.
The concern is inexpensive Android TV streaming boxes, often made in China and sold in the US under different brand names. Brands shown in the coverage include Mecool, YOKATV and STRONG. The reporting does not name streaming devices from established brands as part of this problem.
The alert box above lists the steps. In short, check your box against Google's findings, take a suspect one off your network, and do not rely on a reset.
The material does not give a full list of affected models. It also does not say whether trustworthy clean firmware exists for each one. If you own a budget box and cannot confirm it is safe, treat it with caution.
If you own a cheap Android TV box, check its brand and model, unplug it if it looks suspect, and do not trust a factory reset to fix it.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
