McAfee’s Mobile Research Team discovered a software library named Goldoson, which collects lists of applications installed, and a history of Wi-Fi and Bluetooth devices information, including nearby GPS locations.

Moreover, the library is armed with the functionality to perform ad fraud by clicking advertisements in the background without the user’s consent. The research team has found more than 60 applications containing this third-party malicious library, with more than 100 million downloads confirmed in the ONE store and Google Play app download markets in South Korea.

While the malicious library was made by someone else, not the app developers, the risk to installers of the apps remains. 

Some of the impacted apps are

  • L.POINT with L.PAY – 10 million downloads
  • Swipe Brick Breaker – 10 million downloads
  • Money Manager Expense & Budget – 10 million downloads
  • GOM Player – 5 million downloads
  • LIVE Score, Real-Time Score – 5 million downloads
  • Pikicast – 5 million downloads
  • Compass 9: Smart Compass – 1 million downloads
  • GOM Audio – Music, Sync lyrics – 1 million downloads
  • LOTTE WORLD Magicpass – 1 million downloads
  • Bounce Brick Breaker – 1 million downloads
  • Infinite Slice – 1 million downloads
  • SomNote – Beautiful note app – 1 million downloads
  • Korea Subway Info: Metroid – 1 million downloads

How does it affect users? 

The Goldoson library registers the device and gets remote configurations at the same time the app runs. The library name and the remote server domain vary with each application, and it is obfuscated.

READ
CERT-In Finds Multiple Bugs in Google Chrome, SAP Products

The remote configuration contains the parameters for each of the functionalities and it specifies how often it runs the components. Based on the parameters, the library periodically checks, pulls device information, and sends them to the remote servers. The tags such as ‘ads_enable’ or ‘collect_enable’ indicates whether each functionality works or not while other parameters define conditions and availability. 

A response to remote configuration

The library includes the ability to load web pages without user awareness. The functionality may be abused to load ads for financial profit. Technically, the library loads HTML code and injects it into a customized and hidden WebView and it produces hidden traffic by visiting the URLs recursively. 

Collected data is sent out periodically every two days but the cycle is subject to change by the remote configuration. The information contains some sensitive data including the list of installed applications, location history, MAC address of Bluetooth and Wi-Fi nearby, and more. This may allow individuals to be identified when the data is combined. The following tables show the data observed on our test device. 

Google Play considers the list of installed apps to be personal and sensitive user data and requires a special permission declaration to get it. Users with Android 11 and above are more protected against apps attempting to gather all installed apps. However, even with the recent version of Android, we found that around 10% of the apps with Goldoson have the permission “QUERY_ALL_PACKAGES” that allows them to access app information. 

READ
Hacker Claims to Have 30 Million Customer Records from Australian Ticket Seller Giant TEG
Buy Me A Coffee

Identified Apps and Goldoson Domains

Domains

  • bhuroid.com
  • enestcon.com
  • htyyed.com
  • discess.net
  • gadlito.com
  • gerfane.com
  • visceun.com
  • onanico.net
  • methinno.net
  • goldoson.net
  • dalefs.com
  • openwor.com
  • thervide.net
  • soildonutkiel.com
  • treffaas.com
  • sorrowdeepkold.com
  • hjorsjopa.com
  • dggerys.com
  • ridinra.com
  • necktro.com
  • fuerob.com
  • phyerh.net
  • ojiskorp.net
  • rouperdo.net
  • tiffyre.net
  • superdonaldkood.com
  • soridok2kpop.com

List of Apps and Current Status

Package Name Application Name GooglePlay Downloads GP
Status 
com.lottemembers.android L.POINT with L.PAY 10M+  Updated* 
com.Monthly23.SwipeBrickBreaker Swipe Brick Breaker 10M+ Removed** 
com.realbyteapps.moneymanagerfree Money Manager Expense & Budget 10M+ Updated* 
com.skt.tmap.ku TMAP – 대리,주차,전기차 충전,킥보 … 10M+ Updated* 
kr.co.lottecinema.lcm 롯데시네마 10M+ Updated* 
com.ktmusic.geniemusic 지니뮤직 – genie 10M+ Updated* 
com.cultureland.ver2 컬쳐랜드[컬쳐캐쉬] 5M+ Updated* 
com.gretech.gomplayerko GOM Player 5M+ Updated* 
com.megabox.mop 메가박스(Megabox) 5M+ Removed** 
kr.co.psynet LIVE Score, Real-Time Score 5M+ Updated* 
sixclk.newpiki Pikicast 5M+ Removed** 
com.appsnine.compass Compass 9: Smart Compass 1M+ Removed** 
com.gomtv.gomaudio GOM Audio – Music, Sync lyrics 1M+ Updated* 
com.gretech.gomtv 곰TV – All About Video 1M+ Updated* 
com.guninnuri.guninday 전역일 계산기 디데이 곰신톡–군인 … 1M+ Updated* 
com.itemmania.imiapp  아이템매니아 – 게임 아이템 거래 … 1M+ Removed** 
com.lotteworld.android.lottemagicpass LOTTE WORLD Magicpass 1M+ Updated* 
com.Monthly23.BounceBrickBreaker Bounce Brick Breaker 1M+ Removed** 
com.Monthly23.InfiniteSlice Infinite Slice 1M+ Removed** 
com.pump.noraebang 나홀로 노래방–쉽게 찾아 이용하는 … 1M+ Updated* 
com.somcloud.somnote SomNote – Beautiful note app 1M+ Removed** 
com.whitecrow.metroid Korea Subway Info : Metroid 1M+ Updated* 
kr.co.GoodTVBible GOODTV다번역성경찬송 1M+ Removed** 
kr.co.happymobile.happyscreen 해피스크린 – 해피포인트를 모으 … 1M+ Updated* 
kr.co.rinasoft.howuse UBhind: Mobile Tracker Manager 1M+ Removed** 
mafu.driving.free 스피드 운전면허 필기시험 … 1M+ Removed** 
com.wtwoo.girlsinger.worldcup 이상형 월드컵 500K+ Updated* 
kr.ac.fspmobile.cu CU편의점택배 500K+ Removed** 
com.appsnine.audiorecorder 스마트 녹음기 : 음성 녹음기 100K+ Removed** 
com.camera.catmera 캣메라 [순정 무음카메라] 100K+ Removed** 
com.cultureland.plus 컬쳐플러스:컬쳐랜드 혜택 더하기 … 100K+ Updated* 
com.dkworks.simple_air 창문닫아요(미세/초미세먼지/WHO … 100K+ Removed** 
com.lotteworld.ticket.seoulsky 롯데월드타워 서울스카이 100K+ Updated* 
com.Monthly23.LevelUpSnakeBall Snake Ball Lover 100K+ Removed** 
com.nmp.playgeto 게토(geto) – PC방 게이머 필수 앱 100K+ Removed** 
com.note.app.memorymemo 기억메모 – 심플해서 더 좋은 메모장 100K+ Removed** 
com.player.pb.stream 풀빵 : 광고 없는 유튜브 영상 … 100K+ Removed** 
com.realbyteapps.moneya Money Manager (Remove Ads) 100K+ Updated* 
com.wishpoke.fanciticon Inssaticon – Cute Emoticons, K 100K+ Removed** 
marifish.elder815.ecloud 클라우드런처 100K+ Updated* 
com.dtryx.scinema 작은영화관 50K+ Updated* 
com.kcld.ticketoffice 매표소–뮤지컬문화공연 예매& … 50K+ Updated* 
com.lotteworld.ticket.aquarium 롯데월드 아쿠아리움 50K+ Updated* 
com.lotteworld.ticket.waterpark 롯데 워터파크 50K+ Updated* 
com.skt.skaf.l001mtm091 T map for KT, LGU+ 50K+ Removed** 
org.howcompany.randomnumber 숫자 뽑기 50K+ Updated* 
com.aog.loader 로더(Loader) – 효과음 다운로드 앱 10K+ Removed** 
com.gomtv.gomaudio.pro GOM Audio Plus – Music, Sync l 10K+ Updated* 
com.NineGames.SwipeBrickBreaker2 Swipe Brick Breaker 2 10K+ Removed** 
com.notice.safehome 안심해 – 안심귀가 프로젝트 10K+ Removed** 
kr.thepay.chuncheon 불러봄내 – 춘천시민을 위한 공공  … 10K+ Removed** 
com.curation.fantaholic 판타홀릭 – 아이돌 SNS 앱 5K+ Removed** 
com.dtryx.cinecube 씨네큐브 5K+ Updated* 
com.p2e.tia.tnt TNT 5K+ Removed** 
com.health.bestcare 베스트케어–위험한 전자기장, … 1K+ Removed** 
com.ninegames.solitaire InfinitySolitaire 1K+ Removed** 
com.notice.newsafe 안심해 : 안심지도 1K+ Removed** 
com.notii.cashnote 노티아이 for 소상공인 1K+ Removed** 
com.tdi.dataone TDI News – 최초 데이터 뉴스 앱 … 1K+ Removed** 
com.ting.eyesting 눈팅 – 여자들의 커뮤니티 500+ Removed** 
com.ting.tingsearch 팅서치 TingSearch 50+ Removed** 
com.celeb.tube.krieshachu 츄스틱 : 크리샤츄 Fantastic 50+ Removed** 
com.player.yeonhagoogokka 연하구곡 10+ Removed** 

* Updated means that the recent application on Google Play does not contain the malicious library. 

READ
USB Color Code: Unlocking the Secrets Behind the Different USB Port Colors

** Removed means the application is not available on Google Play as of the time of posting.