Over a million TV boxes had malware directly from the factory. Google itself has now put a stop to the manufacturer

There are many cheap TV boxes on the market, and they are literally manufactured by anyone. Usually, you buy them, connect them, and don’t worry about them much, at most deciding to get a newer generation model after a few years. However, a recent report from Google’s security team now shows that some TV boxes arrived to buyers with pre-installed malware. The company specifically refers to devices from the Chinese company Videostrong, which is behind the popular brand MECOOL.

The manufacturer was allegedly selling backdoors to other criminals

According to Google’s report, the malicious software was built directly into the firmware and ran with system privileges. Therefore, the user could not simply uninstall it. Videostrong then sold access to the infected boxes to other groups, which ran their own modules on them. The so-called botnet, a network of infected devices, comprised over 1.3 million boxes.

The boxes secretly clicked on ads, lent their owners’ internet connections to strangers as so-called residential proxies, and downloaded further malware. Google also detected operators taking screenshots on the devices, simulating key presses, and sending sensitive data, including account information. The malware also stealthily managed to disable Google Play Protect protection.

According to Google, this was not a problem that could have been caused by, for example, a single employee’s error. The malware was found in a number of models and brands, going back several years. The research firm Synthient also participated in the discovery, which, according to BleepingComputer, was led to the trail by a MECOOL KM9 Pro Max box purchased last autumn. Documents created by Videostrong’s development director were allegedly found on the attackers’ servers. The malicious packages were even said to be signed with Videostrong’s emails.

Google cut off the manufacturer, but the problem doesn’t disappear

Google, together with Japanese police and security firms, disabled the botnet’s command and control servers. According to Google, this also cut off at least 10 million other devices infected with related types of malware. Videostrong is no longer allowed to manufacture devices with pre-installed Google applications, and Google has also adjusted its certification, as the malware bypassed its tests by being uploaded only after the first boot.

The 9to5Google server is optimistic: without command and control servers, the infected boxes should be safe, but owners should consider a replacement. BleepingComputer, however, is more cautious. The malicious code reportedly remains in the boxes, and if you delete it, it reinstalls itself after a restart from the system partition. According to them, only clean firmware or disconnecting the box from the internet will reliably help. But the firmware is supplied by the manufacturer.

MECOOL boxes were also sold in the Czech Republic, with Alza offering models such as KM9 Pro, KM2 Plus, and KM7 Plus. Whether these are also affected, we do not yet know for sure. However, you have one clue: the malware disables Google Play Protect. If you have it disabled in the Play Store on your box and you didn’t do it yourself, that’s a warning sign.

Google previously warned against unofficial boxes without certification. Now it has been shown that even a certificate is not a 100% guarantee. If you are still choosing a new box, Google recommends opting for an established brand from the list of partners on the Android TV website.

Do you use a MECOOL TV box or another less-known brand at home?

Sources: Google, BleepingComputer, Android Authority, 9to5Google