Story image

Low-cost Android devices shipping pre-installed Colisoon adware

29 May 2018

Android devices from manufacturers such as ZTE and Archos are being pre-installed with adware, researchers at Avast say.

The adware has been pre-installed on several hundred device models and versions - generally ‘low-cost’ Android devices that use a Mediatek chipset.

Although Google is already cracking down on affected apps, the problem is actually far more difficult.

Avast researchers Vojtech Bocek and Nikolaos Chrysaidos posted in a blog this week that the adware, dubbed ‘Cosiloon’, is installed on many devices that are not certified by Google.

The Colisoon adware uses an overlay to display ads over webpages in a users’ browser. The malware family is old, however it is still very much active and constantly updated with new payloads.

The researchers suspect that the latest version of the adware has been included on at least 18,000 Avast users’ devices. Those users are located in more than 100 countries.

The overlay popups have rate limiting to control how often they are displayed, while the full screen advertisement also includes a check that allows it to display solely over the current default web browser.

While Google is mitigating the malicious app on several device models and Google Play Protect has been updated, Avast researchers say the problem is actually much more complex.

The adware usually comes pre-installed with the firmware and uses strong obfuscation techniques, which makes it difficult to remove.

“Google has reached out to the firmware developers to bring awareness to these concerns and encouraged them to take steps to address the issue,” Bocek and Chrysaidos explain.

When the researchers analysed the adware samples, they discovered that there was no specific point of infection and had similar package names, including com.google.eMediaService, com.google.eMusic1Service, com.google.ePlay3Service, and com.google.eVideo2Service.

They tracked the packages down to a payload from a system application that was preinstalled by the manufacturer on various devices.

“Detecting the dropper is further complicated by the fact that it is a system app, part of the devices’ read-only firmware, which is integrated in the device shipped from the factory,” they state.

The earliest dropper sample was from 2015 and preinstalled on a budget tablet sold in Poland. Dating from some other samples go back as far as 2013.

Researchers say they have tried to disable the Colisoon command and control server by requesting takedowns, however it keeps popping up again.

“This adware family also has many variants of both payloads and droppers, indicating continuous development.”

The researchers not that so far the dropper only installs adware, but it could also be used to download other malware including spyware and ransomware.

 “Avast Mobile Security can detect and uninstall the payload, but it cannot acquire the permissions required to disable the dropper, so Google Play Protect has to do the heavy lifting. If your device is infected, it should automatically disable both the dropper and the payload. We know this works because we have observed a drop in the number of devices infected by new payload versions after Play Protect started detecting Cosiloon.”

Users can find the dropper in their settings (named “CrashService”, “ImeMess” or “Terminal” with generic Android icon), and can click the "disable" button on the app's page, if available (depending on the Android version). This will deactivate the dropper and once Avast removes the payload, it will not return again.”

Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Ensign and IronNet partner to create cyber analytics capabilities
The Singapore-based joint venture will form a Cyber Analytics Center for Excellence focused on securing regional enterprises from sophisticated cyber threats.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.