The set-top boxes shipped under a dozen brand names, most of them unfamiliar, listed on online marketplaces beside cheap chargers and phone cases. Buyers plugged them into living-room televisions, signed into streaming accounts and thought little more about them. Inside, according to a report from The Verge, roughly 1.3 million of the devices carried something the buyers had not paid for: a backdoor written into the firmware while the hardware was still on the assembly line.
Google traced the tampering to Videostrong, a contract manufacturer that builds Android TV boxes for outside brands. According to the report, the company’s production process enrolled each device in a botnet that Google named XCPE, which was then put to work in advertising fraud and traffic hijacking. Google has ended its relationship with the manufacturer and started cleaning the infected devices.
The operation was designed to be dull. Nothing about it asked a viewer to click a link or approve a prompt. The box streamed television as advertised, and the intrusion sat below the layer where an ordinary user would ever look. What the operator sold was the appearance of an ordinary household: residential internet connections tied to real addresses, available to anyone who needed traffic that did not look like it came from a server farm.
That market is large because advertisers have spent two decades trying to separate humans from software. Measured impressions, verified views and brand-safety guarantees all rest on signals that a device is genuine. A television in a living room, switched on during prime time, is close to the strongest signal available. A botnet that can borrow a million of those televisions can bill for audiences that never existed, and can do it slowly enough that the pattern resembles ordinary viewing.
Traffic hijacking is the cruder half. Devices under an operator’s control can have their domain lookups redirected, their ad slots filled from a different exchange, their clicks counted somewhere else. For the household, the visible symptom may be nothing more than a sluggish menu or an advertisement that appears in the wrong place. For the advertiser, the loss disappears into a monthly invoice.
What makes the case unusual is where the code entered. Cheap streaming hardware is rarely built by the brand printed on the box. A retailer or a licensing partner orders a run of devices from an original design manufacturer, which assembles them from reference designs and ships them with the manufacturer’s firmware and a brand’s logo on the packaging. Google’s Android TV certification is meant to police that process, giving the company a say over what runs on licensed devices. The tampering happened at a partner that already had that access, according to the report.
Security researchers have seen the shape of this before. A botnet known as Badbox spread through inexpensive Android devices that arrived from the factory already infected, and it survived several rounds of takedowns before reappearing in new hardware. The common thread is economic. Margins on a device that sells for the price of a dinner come from components, assembly and firmware, and the firmware is the part no customer ever inspects. For a factory paid per unit, a line that can monetize its own output without an invoice is difficult to resist.
Remediation is the harder problem. Google can revoke a manufacturer’s access and push clean software to devices that still check in, but a television in a rental flat, a dentist’s waiting room or a budget hotel may go months without an update. The person watching it has no reason to suspect the box, and no screen will explain why the picture looks exactly as it did before. Cleaning reaches the devices that respond; the rest stay where they are.
The brands involved were, for the most part, interchangeable. Boxes like these are sold under names that exist for a season and then vanish, replaced by another label on the same reference board. That structure makes accountability thin. A buyer who wants redress has a receipt from an online seller, a box with a logo and no practical way to learn which factory touched the firmware last.
Google has argued for years that certification and automatic updates are the answer, and its platform security record is better than most. The Videostrong episode shows where that argument stops. Certification is a promise about a process, and the process runs through factories Google does not own and cannot watch continuously. The same gap exists for every company that licenses an operating system and lets someone else cut the metal.
For advertisers paying for those impressions, the arithmetic is simple even when the details are not. Money spent on audiences that were never there is money not spent on audiences that were. The devices, meanwhile, keep working. That is what makes them useful.
