Google Takes Down Huge Android TV Box Botnet, Blames Maker of Supplying Access

Google said it had taken apart a botnet of over 1.3 million Android devices, most being internet‑connected TV set‑top boxes. The effort, finished in late October, severed the malicious servers that were directing the hijacked hardware.

The commandeered devices were employed for a range of illegal actions, from click‑fraud operations to pushing unwanted ads. Because these boxes run a customized Android build, they appealed to attackers looking for a vast, inexpensive, always‑on pool of endpoints they could control remotely.

Google identifies the device manufacturer Videostrong as the focal point of the dispute. The firm is accused of intentionally inserting a backdoor into its TV boxes and then selling that access to third‑party buyers who could misuse the devices for profit. Google asserts the evidence suggests a deliberate scheme rather than a mere security lapse.

The security team at Google spotted the abnormal traffic in early October and worked with partners to capture the command‑and‑control infrastructure. By shutting down the servers that issued orders to the infected boxes, the company effectively neutralized the botnet. Google said its confidence in the takedown was “high,” noting that the devices could no longer receive commands after the operation.

The takedown should cut down the number of fraudulent ad impressions and other automated abuse that depended on the botnet’s size. While the precise financial loss for the criminals is unknown, removing the command channel takes away a vital tool and could discourage similar schemes that rely on bulk‑purchased, insecure hardware.

Security analysts say the episode highlights a widening issue in the Internet of Things space, where makers sometimes favor rapid market entry over solid security. Android‑based TV boxes have been singled out in recent years for weak default passwords and unpatched software, making them prime targets for botnet recruitment.

Google has not said whether it will bring legal action against Videostrong, but the public attribution could trigger regulatory scrutiny and possible lawsuits. Observers advise consumers to look for firmware updates on any connected TV gear and consider turning off unnecessary network services. The case also reminds manufacturers to enforce stricter security standards and platform providers to monitor abuse more proactively.