Researchers from McAfee’s Mobile Research Team have discovered a new Android malware called Goldoson that was distributed through over 60 legitimate apps on the official Google Play store. The malware collects lists of applications installed on a device, as well as Wi-Fi and Bluetooth devices information, including nearby GPS locations.
The third-party library can perform ad fraud by clicking advertisements in the background without the user’s consent. The experts found over 60 applications on Google Play that contained the malicious library, which totaled over 100 million downloads in South Korea’s ONE store and Google Play stores.
It is worth noting that the library was not developed by the authors of the apps.
Furthremore, the security firm has reported its findings to Google, which has notified the development teams. Some apps were updated by removing the malicious library, while other apps were removed from Google Play. The library registers the device and gets configurations from a remote server. “Remote configuration contains the parameters for each of functionalities and it specifies how often it runs the components.
Additionally, based on the parameters, the library periodically checks, pulls device information, and sends them to the remote servers,” reads the analysis published by the security firm. The library can load web pages without user awareness, meaning that the malware can load ads for financial profit.
At the same time, the collected data is sent to the C2 server every two days, but the cycle depends on the remote configuration. The level of data collection depends on the permissions granted to the app using the malicious library.
McAfee discovered that even in recent Android versions, Goldoson was able to gather sensitive data in 10% of the apps. The security firm has warned that app developers should be upfront about libraries used and take precautions to protect users’ information.
As applications continue to scale in size and leverage additional external libraries, it is important to understand their behavior.
