Source: The Verge
Videostrong, a Google-approved Android TV manufacturer, embedded malicious code into firmware updates that converted set-top boxes into a botnet for cryptocurrency mining and DDoS attacks. Google failed to detect the breach. The incident exposes gaps in how Google vets and monitors hardware partners, particularly in markets where set-top boxes serve as gateways to connected home networks. Supply chain compromises at the component level can persist at scale without detection, raising questions about how major platforms enforce security obligations among global manufacturing partners.