Google Takes Down 1.3 Million‑Device Android TV Box Botnet, Blames Manufacturer of Selling Access

Google said it had dismantled a botnet of more than 1.3 million Android devices, the bulk of them internet‑connected TV set‑top boxes. The effort, completed in late October, cut off the malicious servers that were steering the compromised hardware.

The hijacked devices were employed for a range of illicit activities, from click‑fraud schemes to the distribution of unwanted advertisements. Because the boxes run a customized Android version, they appealed to attackers seeking cheap, always‑on endpoints that could be remotely managed.

Google identified the maker Videostrong as the focal point of the controversy. The company is accused of deliberately embedding a backdoor in its TV boxes and then offering that access to third‑party buyers who could exploit the devices for profit. Google says the evidence points to an intentional scheme rather than a simple security oversight.

Google’s security team detected the anomalous traffic patterns in early October and coordinated with partners to seize control of the command‑and‑control infrastructure. By disabling the servers that issued instructions to the compromised boxes, the company effectively rendered the botnet inoperable. Google described its confidence in the takedown as “high,” noting that the compromised devices lost any ability to receive further commands after the operation.

The disruption is expected to lower the volume of fraudulent ad impressions and other automated abuse that relied on the botnet’s scale. While the exact financial impact on the criminal operators remains unclear, cutting off the command channel removes a critical tool from their arsenal and may deter similar schemes that depend on bulk‑purchased, insecure hardware.

Security experts say the case underscores a growing problem in the Internet of Things ecosystem, where manufacturers sometimes prioritize rapid market entry over robust security practices. Android‑based TV boxes, in particular, have been flagged in recent years for weak default passwords and unpatched software, making them fertile ground for botnet recruitment.

Google has not indicated whether it will pursue legal action against Videostrong, but the public attribution may invite regulatory scrutiny and potential lawsuits. Industry observers recommend that consumers check for firmware updates on any connected TV devices and consider disabling unnecessary network services. The incident also serves as a reminder for manufacturers to adopt stricter security standards and for platform providers to monitor for abuse more proactively.