In a development that should surprise absolutely no one who has ever glanced suspiciously at a cheap streaming box, Google has confirmed that one of its Android manufacturing partners secretly built a backdoor into 1.3 million devices and turned them into a botnet. The company says it has now dismantled the backdoor and "cut ties" with the manufacturer, Shenzhen, China-based Videostrong Technology Co., which has been banned from building or selling certified Android devices or supplying software for them.

The infected devices were used without owners' knowledge for "malicious activity," including ad fraud, data exfiltration, and routing unauthorized network traffic. Google claims the "backdoor and botnet were intentionally developed, deployed, and operated for financial gain." Shocking, we know. In a statement, the company explained that Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices. These secondary modules conducted ad fraud, silently enrolled infected devices into residential proxy networks, and loaded additional malware onto XCPE-compromised devices.

Google also took action to disrupt the command and control (C2) domains operating these affiliate modules. Because the affiliates each have diversified distribution channels beyond XCPE, Google assesses that taking down their C2 domains will sever access to at least 10 million additional compromised devices. So, a silver lining: only 10 million more devices were in on the fun.

It wasn't just one device model impacted, either - the malware was found "built directly into many different device models and brands over multiple years." Most were Android TV set-top boxes, but the botnet also infected other "Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices." Because nothing says "trusted medical equipment" like a side of ad fraud.

Google says Videostrong used "obfuscation techniques" to load the malware onto users' devices after they booted up the hardware for the first time. The company also says it made changes to its review process for device manufacturers after this incident - presumably involving fewer winks and more actual checking.