Story image

Low-cost Android devices shipping pre-installed Colisoon adware

29 May 2018

Android devices from manufacturers such as ZTE and Archos are being pre-installed with adware, researchers at Avast say.

The adware has been pre-installed on several hundred device models and versions - generally ‘low-cost’ Android devices that use a Mediatek chipset.

Although Google is already cracking down on affected apps, the problem is actually far more difficult.

Avast researchers Vojtech Bocek and Nikolaos Chrysaidos posted in a blog this week that the adware, dubbed ‘Cosiloon’, is installed on many devices that are not certified by Google.

The Colisoon adware uses an overlay to display ads over webpages in a users’ browser. The malware family is old, however it is still very much active and constantly updated with new payloads.

The researchers suspect that the latest version of the adware has been included on at least 18,000 Avast users’ devices. Those users are located in more than 100 countries.

The overlay popups have rate limiting to control how often they are displayed, while the full screen advertisement also includes a check that allows it to display solely over the current default web browser.

While Google is mitigating the malicious app on several device models and Google Play Protect has been updated, Avast researchers say the problem is actually much more complex.

The adware usually comes pre-installed with the firmware and uses strong obfuscation techniques, which makes it difficult to remove.

“Google has reached out to the firmware developers to bring awareness to these concerns and encouraged them to take steps to address the issue,” Bocek and Chrysaidos explain.

When the researchers analysed the adware samples, they discovered that there was no specific point of infection and had similar package names, including com.google.eMediaService, com.google.eMusic1Service, com.google.ePlay3Service, and com.google.eVideo2Service.

They tracked the packages down to a payload from a system application that was preinstalled by the manufacturer on various devices.

“Detecting the dropper is further complicated by the fact that it is a system app, part of the devices’ read-only firmware, which is integrated in the device shipped from the factory,” they state.

The earliest dropper sample was from 2015 and preinstalled on a budget tablet sold in Poland. Dating from some other samples go back as far as 2013.

Researchers say they have tried to disable the Colisoon command and control server by requesting takedowns, however it keeps popping up again.

“This adware family also has many variants of both payloads and droppers, indicating continuous development.”

The researchers not that so far the dropper only installs adware, but it could also be used to download other malware including spyware and ransomware.

 “Avast Mobile Security can detect and uninstall the payload, but it cannot acquire the permissions required to disable the dropper, so Google Play Protect has to do the heavy lifting. If your device is infected, it should automatically disable both the dropper and the payload. We know this works because we have observed a drop in the number of devices infected by new payload versions after Play Protect started detecting Cosiloon.”

Users can find the dropper in their settings (named “CrashService”, “ImeMess” or “Terminal” with generic Android icon), and can click the "disable" button on the app's page, if available (depending on the Android version). This will deactivate the dropper and once Avast removes the payload, it will not return again.”

SecOps: Clear opportunities for powerful collaboration
If there’s one thing security and IT ops professionals should do this year, the words ‘team up’ should be top priority.
Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.