Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea

Authored
by
SangRyol
Ryu

McAfee’s

Mobile
Research
Team
discovered
a

software

library

we’ve

named

Goldoson,

which

collects
lists
of
applications
installed,
and

a
history
of

Wi-Fi
and

Bluetooth

devices
information,
including

nearby
GPS
locations.

Moreover,
the
library
is
armed
with
the functionality

to
perform
ad
fraud
by
clicking
advertisements
in
the
background
without
the
user’s
consent.

The
research
team
has
found
more
than
60
applications
containing
this

third-party

malicious
library,
with
more
than

100

million
downloads
confirmed
in
the

ONE
store
and
Google
Play

app
download

markets

in
South
Korea.

While
the
,

the

risk
to

installers
of
the
apps

remains. 

McAfee
Mobile
Security


detects

this
threat
as
Android/Goldoson

and
protects

customers

from
this
and
many
other
mobile
threats.

McAfee

is

a
member
of
the



App
Defense
Alliance


focused
on
protecting
users
by
preventing
threats
from
reaching
their
devices
and
improving
app
quality
across
the
ecosystem.
We

reported
the
discovered
apps
to
Google,
which
took
prompt
action.

reportedly

notified

the
developers
that
their
apps
are
in
violation
of
Google
Play
policies
and
fixes
are
needed
to

reach

compliance.

Some
apps
were
removed
from
Google
Play
while
others
were
updated
by
the
official
developers.

Users

are
encouraged
to
update
the

apps

to
the
latest
version
to
remove

the

identified

threat

from
their
devices. 

Top
9
applications
previously
infected
by
Goldoson
on
Google
Play

How
does
it
affect
users? 

The

Goldoson

library

registers
the
device
and

gets
remote
configurations
at
the
same
time

the
app

runs.

The
library

name

and
the
remote
server

domain

varies

with

each

application,

and
it
is

obfuscated.

The
name

Goldoson

is
after
the
first
found
domain
name. 

Remote
configuration

contains

the
parameters
for
each

of

functionalities
and

it

specifies
how
often

it

runs
the
components.
Based
on
the
parameters,
the
library
periodically
checks,

pulls
device

information,

and
sends

them
to
the

remote

servers.

The
tags
such
as
‘ads_enable’
or
‘collect_enable’

indicates

each
functionality
to
work
or
not

while

other
parameters
define
conditions
and
availability. 

A
response
of
remote
configuration

The
library

includes

the

ability
to
load

web
pages
without
user

awareness.

The
functionality

may
be

abused
to
load
ads

for

financial

profit.

Technically,

the
library
loads
HTML
code
and
injects

it
into

a
customized
and

hidden

WebView

and
it

produces

hidden

traffic
by
visiting

the

URLs

recursively. 

Collected
data

is

sent
out
periodically

every
two
days
but
the
cycle
is
subject
to
change
by
the
remote
configuration.

The
information

contains

some
sensitive
data
including
the
list
of
installed
applications,
location
history,
MAC
address
of
Bluetooth
and

Wi-Fi

nearby,
and
more.
This
may

allow

individuals

to
be

identified

when
the
data

is

combined.

The
following
tables

show

the
data

observed

on
our
test
device. 

Google
Play
considers
the
list
of
installed

apps
to
be personal
and
sensitive
user
data


and
requires

a
special
permission
declaration
to
get
it.

Users
with
Android

11
and

above
are
more
protected
against
apps

attempting

to
gather
all
installed
apps.
However,
even
with
the
recent
version
of
Android,
we
found
that
around
10%
of
the
apps
with

Goldoson

have
the
permission
“QUERY_ALL_PACKAGES”

that
allows
them
to

access

app

information. 

Likewise,

with

Android
6.0
or
higher,

users

may

be
asked
for

permissions

such
as

Location,

Storage,

or
Camera

at
runtime.

If

user

allows
the
location
permission,
the
app
can
access
not
only
GPS
data
but
also
Wi-Fi
and
Bluetooth
device
information
nearby.
Based
on

BSSID
(Basic
Service
Set
Identifier)
and
RSSI
(Received
Signal
Strength
Indicator),

the
application
can

determine

the
location

of
the
device

more
accurately

than
GPS,

especially

indoors. 

A
demo
of
runtime
permission
request

Where
do
the
apps
come
from?

The
infected
applications
come
from
various

Android

application
stores.

More
than


100


million
downloads
have
been
tracked
through
Google
Play.

After
that,

ONE

store,
Korea’s
leading
app
store,

follows
with

about

8

million

installations. 

Conclusion

As

applications

continue
to
scale
in

size

and
leverage
additional

external
libraries,
it
is
important

to

understand

their

behavior.

App
developers
should
be
upfront
about

libraries

used
and
take

precautions

to
protect

users’
information.

McAfee
Mobile
Security
products

can
also
help

detect
threats

and
protect
you
from
not
only

malware
but

also
unwanted
programs.
For
more
information,
visit
our



McAfee
Mobile
Security. 

Identified
Apps
and
Goldoson
Domains

Domains

• bhuroid.com
• enestcon.com
• htyyed.com
• discess.net
• gadlito.com
• gerfane.com
• visceun.com
• onanico.net
• methinno.net
• goldoson.net
• dalefs.com
• openwor.com
• thervide.net
• soildonutkiel.com
• treffaas.com
• sorrowdeepkold.com
• hjorsjopa.com
• dggerys.com
• ridinra.com
• necktro.com
• fuerob.com
• phyerh.net
• ojiskorp.net
• rouperdo.net
• tiffyre.net
• superdonaldkood.com
• soridok2kpop.com

List
of
Apps
and
Current
Status

*
Updated
means
that
the
recent
application
on
Google
Play
does
not
contain
the
malicious
library. 

**
Removed
means
the
application
is
not
available
on
Google
Play
as
of
the
time
of
posting. 

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts