Story image

Low-cost Android devices shipping pre-installed Colisoon adware

29 May 18

Android devices from manufacturers such as ZTE and Archos are being pre-installed with adware, researchers at Avast say.

The adware has been pre-installed on several hundred device models and versions - generally ‘low-cost’ Android devices that use a Mediatek chipset.

Although Google is already cracking down on affected apps, the problem is actually far more difficult.

Avast researchers Vojtech Bocek and Nikolaos Chrysaidos posted in a blog this week that the adware, dubbed ‘Cosiloon’, is installed on many devices that are not certified by Google.

The Colisoon adware uses an overlay to display ads over webpages in a users’ browser. The malware family is old, however it is still very much active and constantly updated with new payloads.

The researchers suspect that the latest version of the adware has been included on at least 18,000 Avast users’ devices. Those users are located in more than 100 countries.

The overlay popups have rate limiting to control how often they are displayed, while the full screen advertisement also includes a check that allows it to display solely over the current default web browser.

While Google is mitigating the malicious app on several device models and Google Play Protect has been updated, Avast researchers say the problem is actually much more complex.

The adware usually comes pre-installed with the firmware and uses strong obfuscation techniques, which makes it difficult to remove.

“Google has reached out to the firmware developers to bring awareness to these concerns and encouraged them to take steps to address the issue,” Bocek and Chrysaidos explain.

When the researchers analysed the adware samples, they discovered that there was no specific point of infection and had similar package names, including com.google.eMediaService, com.google.eMusic1Service, com.google.ePlay3Service, and com.google.eVideo2Service.

They tracked the packages down to a payload from a system application that was preinstalled by the manufacturer on various devices.

“Detecting the dropper is further complicated by the fact that it is a system app, part of the devices’ read-only firmware, which is integrated in the device shipped from the factory,” they state.

The earliest dropper sample was from 2015 and preinstalled on a budget tablet sold in Poland. Dating from some other samples go back as far as 2013.

Researchers say they have tried to disable the Colisoon command and control server by requesting takedowns, however it keeps popping up again.

“This adware family also has many variants of both payloads and droppers, indicating continuous development.”

The researchers not that so far the dropper only installs adware, but it could also be used to download other malware including spyware and ransomware.

 “Avast Mobile Security can detect and uninstall the payload, but it cannot acquire the permissions required to disable the dropper, so Google Play Protect has to do the heavy lifting. If your device is infected, it should automatically disable both the dropper and the payload. We know this works because we have observed a drop in the number of devices infected by new payload versions after Play Protect started detecting Cosiloon.”

Users can find the dropper in their settings (named “CrashService”, “ImeMess” or “Terminal” with generic Android icon), and can click the "disable" button on the app's page, if available (depending on the Android version). This will deactivate the dropper and once Avast removes the payload, it will not return again.”

McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.
Using blockchain to ensure regulatory compliance
“Data privacy regulations such as the GDPR require you to put better safeguards in place to protect customer data, and to prove you’ve done it."
A10 aims to secure Kubernetes container environments
The solution aims to provide teams deploying microservices applications with an automated way to integrate enterprise-grade security with comprehensive application visibility and analytics.
DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill.