Google and its partners recently shared the news of a now-dismantled backdoor that was preinstalled on more than 1.3 million set-top boxes, turning them into nodes in a botnet. According to the company’s official report, the XCPE malware was deliberately deployed by Videostrong, which is an Android device manufacturer.

The backdoor was built directly into the firmware of the affected models over several years. Infected boxes were used for things like ad fraud and data theft. Moreover, units had the ability to route other people’s traffic through the owner’s internet connection, which put anyone using the same network as an infected Android TV box at risk.

These boxes passed Google’s certification for years

And it makes you wonder what else is still out there that Google doesn’t know about

This is certainly not a first for Google, and we can only hope such a large-scale malicious operation is not to be repeated. A very concerning detail is that Videostrong was allowed to manufacture certified Android devices with Google apps. This means the company passed Google’s required security testing that all hardware partners of the company have to go through.

Google says Videostrong used obfuscation to exploit a gap in those tests. The malicious code was designed to load only after the device’s first boot — a sophisticated trick from the bad guys, indeed. At the same time, it’s only natural to raise eyebrows at the questionable series of security and QC checks that failed to catch the malware for years. Checking what the firmware does after first boot should be a bare-minimum precaution. The whole purpose of a certificate is to assure buyers that someone has inspected what they are plugging into their TVs and using to sign in to their Google accounts.

Unfortunately, this is not an isolated weak point, and Google never fails to give us all a shock with news like this now and then. Very recently, Google promoted a fake Chrome app on its official store that showcased a six-figure download count despite copying the real browser’s name, icon, and screenshots. While different, these two cases show how such threats can slip through Google-controlled security gates that users reasonably assume have already covered the basics.

Google now says it has cut ties with Videostrong and banned it from producing certified Android devices. It also says it has changed its review process to ensure nothing like this happens again. Google recommends purchasing set-top boxes only from reputable manufacturers that the company lists as official Android TV partners. While you’re at it, Google, how about double-checking that list of certification holders, too?

Ordinary smart-TV privacy settings can reduce tracking without breaking major features, but they can’t neutralize malware embedded in the firmware. Ideally, a certification should be more than boastful a logo on the packaging. Yet, Google’s security bolts were evidently not tight enough to catch something buyers had every reason to assume was being checked.