Story image

Low-cost Android devices shipping pre-installed Colisoon adware

29 May 18

Android devices from manufacturers such as ZTE and Archos are being pre-installed with adware, researchers at Avast say.

The adware has been pre-installed on several hundred device models and versions - generally ‘low-cost’ Android devices that use a Mediatek chipset.

Although Google is already cracking down on affected apps, the problem is actually far more difficult.

Avast researchers Vojtech Bocek and Nikolaos Chrysaidos posted in a blog this week that the adware, dubbed ‘Cosiloon’, is installed on many devices that are not certified by Google.

The Colisoon adware uses an overlay to display ads over webpages in a users’ browser. The malware family is old, however it is still very much active and constantly updated with new payloads.

The researchers suspect that the latest version of the adware has been included on at least 18,000 Avast users’ devices. Those users are located in more than 100 countries.

The overlay popups have rate limiting to control how often they are displayed, while the full screen advertisement also includes a check that allows it to display solely over the current default web browser.

While Google is mitigating the malicious app on several device models and Google Play Protect has been updated, Avast researchers say the problem is actually much more complex.

The adware usually comes pre-installed with the firmware and uses strong obfuscation techniques, which makes it difficult to remove.

“Google has reached out to the firmware developers to bring awareness to these concerns and encouraged them to take steps to address the issue,” Bocek and Chrysaidos explain.

When the researchers analysed the adware samples, they discovered that there was no specific point of infection and had similar package names, including com.google.eMediaService, com.google.eMusic1Service, com.google.ePlay3Service, and com.google.eVideo2Service.

They tracked the packages down to a payload from a system application that was preinstalled by the manufacturer on various devices.

“Detecting the dropper is further complicated by the fact that it is a system app, part of the devices’ read-only firmware, which is integrated in the device shipped from the factory,” they state.

The earliest dropper sample was from 2015 and preinstalled on a budget tablet sold in Poland. Dating from some other samples go back as far as 2013.

Researchers say they have tried to disable the Colisoon command and control server by requesting takedowns, however it keeps popping up again.

“This adware family also has many variants of both payloads and droppers, indicating continuous development.”

The researchers not that so far the dropper only installs adware, but it could also be used to download other malware including spyware and ransomware.

 “Avast Mobile Security can detect and uninstall the payload, but it cannot acquire the permissions required to disable the dropper, so Google Play Protect has to do the heavy lifting. If your device is infected, it should automatically disable both the dropper and the payload. We know this works because we have observed a drop in the number of devices infected by new payload versions after Play Protect started detecting Cosiloon.”

Users can find the dropper in their settings (named “CrashService”, “ImeMess” or “Terminal” with generic Android icon), and can click the "disable" button on the app's page, if available (depending on the Android version). This will deactivate the dropper and once Avast removes the payload, it will not return again.”

Cofense launches MSSP program to provide phishing defence for SMBs
SMBs are highly susceptible to phishing attacks, and often lack the resources necessary to stop advanced threats
Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Security platform provider Deep Instinct expands local presence
The company has made two A/NZ specific leadership hires and formed several partnerships with organisations in the region.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Stepping up to sell security services in A/NZ
WatchGuard Technologies A/NZ regional director gives his top tips on how to make a move into the increasingly lucrative cybersecurity services market.