McAfee Uncovers Goldoson Malware in 60+ High-Download Mobile Apps on Google Play

McAfee’s Mobile Research Team discovered a software library named Goldoson, which collects lists of applications installed, and a history of Wi-Fi and Bluetooth devices information, including nearby GPS locations.

Moreover, the library is armed with the functionality to perform ad fraud by clicking advertisements in the background without the user’s consent. The research team has found more than 60 applications containing this third-party malicious library, with more than 100 million downloads confirmed in the ONE store and Google Play app download markets in South Korea.

While the malicious library was made by someone else, not the app developers, the risk to installers of the apps remains. 

Some of the impacted apps are

• L.POINT with L.PAY – 10 million downloads
• Swipe Brick Breaker – 10 million downloads
• Money Manager Expense & Budget – 10 million downloads
• GOM Player – 5 million downloads
• LIVE Score, Real-Time Score – 5 million downloads
• Pikicast – 5 million downloads
• Compass 9: Smart Compass – 1 million downloads
• GOM Audio – Music, Sync lyrics – 1 million downloads
• LOTTE WORLD Magicpass – 1 million downloads
• Bounce Brick Breaker – 1 million downloads
• Infinite Slice – 1 million downloads
• SomNote – Beautiful note app – 1 million downloads
• Korea Subway Info: Metroid – 1 million downloads

How does it affect users? 

The Goldoson library registers the device and gets remote configurations at the same time the app runs. The library name and the remote server domain vary with each application, and it is obfuscated.

The remote configuration contains the parameters for each of the functionalities and it specifies how often it runs the components. Based on the parameters, the library periodically checks, pulls device information, and sends them to the remote servers. The tags such as ‘ads_enable’ or ‘collect_enable’ indicates whether each functionality works or not while other parameters define conditions and availability. 

A response to remote configuration

The library includes the ability to load web pages without user awareness. The functionality may be abused to load ads for financial profit. Technically, the library loads HTML code and injects it into a customized and hidden WebView and it produces hidden traffic by visiting the URLs recursively. 

Collected data is sent out periodically every two days but the cycle is subject to change by the remote configuration. The information contains some sensitive data including the list of installed applications, location history, MAC address of Bluetooth and Wi-Fi nearby, and more. This may allow individuals to be identified when the data is combined. The following tables show the data observed on our test device. 

Google Play considers the list of installed apps to be personal and sensitive user data and requires a special permission declaration to get it. Users with Android 11 and above are more protected against apps attempting to gather all installed apps. However, even with the recent version of Android, we found that around 10% of the apps with Goldoson have the permission “QUERY_ALL_PACKAGES” that allows them to access app information. 

Identified Apps and Goldoson Domains

Domains

• bhuroid.com
• enestcon.com
• htyyed.com
• discess.net
• gadlito.com
• gerfane.com
• visceun.com
• onanico.net
• methinno.net
• goldoson.net
• dalefs.com
• openwor.com
• thervide.net
• soildonutkiel.com
• treffaas.com
• sorrowdeepkold.com
• hjorsjopa.com
• dggerys.com
• ridinra.com
• necktro.com
• fuerob.com
• phyerh.net
• ojiskorp.net
• rouperdo.net
• tiffyre.net
• superdonaldkood.com
• soridok2kpop.com

List of Apps and Current Status

* Updated means that the recent application on Google Play does not contain the malicious library. 

** Removed means the application is not available on Google Play as of the time of posting.