Pre-installed malware detected on some Android smartphones

В бюджетных смартфонах на Android обнаружили старый вирус

Avast has been in contact with Google and says the tech giant has reached out to the firmware developers to encourage them to take care of the issue.

The news comes from Avast, which found an adware type of malware that simply loads ads in your browser.

"Malicious apps can, unfortunately, be installed on firmware level before they are shipped to customers, probably without the manufacturer's knowledge", said Nikolaos Chrysaidos, Head of Mobile Threat Intelligence and Security at Avast. The adware servers are still operating, and lots of users have complained about bad ads, the company notes.

The adware has been active for at least three years, and is hard to remove as it is installed on the firmware level and uses strong obfuscation. According to Avast, the countries that are affected by the malware are Russia, Italy, Germany, the United Kingdom, Ukraine, Portugal, Venezuela, Greece, France, and Romania. Google has taken steps to mitigate the malicious capabilities of many app variants on several device models, using internally developed techniques.

The phones concerned belong to manufacturers such as ZTE, Archos, Prestige, and myPhone, and are in all cases low-cost terminals that are not Google-certified, as revealed by a report published by Avast. To make sure that there is some kind of protection in the future, Google Play Protect has been updated. Avast Software has released details about the "Cosiloon" malware on its blog, which has also been found on devices from Archos, Prestigio, and others.


According to the report, it is not clear how the adware got onto the devices.

The only times the malware won't download additional apps is when the device's language is set to Chinese, when the device's public IP address is also from a Chinese IP range, and when the number of locally installed apps is below three (indicating a test/scan environment). Some antivirus apps report the payloads, but the dropper will install them right back again and the dropper itself can't be removed, so the device will forever have a method allowing an unknown party to install any application they want on it.

This means the group is opportunistic and infects devices at random, as it finds a window during which it can poison their firmware. It's also working with providers and domain registrars to get the problematic servers closed down permanently. "Together, we can ensure a safer mobile ecosystem for Android users". "The app is completely passive, only visible to the user in the list of system applications under "settings.' We have seen the dropper with two different names, 'CrashService" and 'ImeMess, '" wrote Avast. If you haven't bought an incredibly cheap Android product without Google Play Services installed over the past few years, you can go about your day worry-free.

Avast says it can detect the payload and uninstall it, but it can't do anything about the dropper that's built into the system.

Related News:

  • Paul receiving regular treatment to return for Rockets

    They lost to the Cavs in the NBA Finals, but that series win set things up for Kevin Durant to eventually join the team . But it's important to remember that the Warriors never needed Durant; he was the cherry on top of a formidable roster.
    Mohamed Salah’s Champions League injury has brought Egypt to tears

    Mohamed Salah’s Champions League injury has brought Egypt to tears

    Liverpool were rocked 30 minutes into the tie in Kiev as their talisman Mo Salah left the field in tears with a shoulder injury. Dejan Lovren headed goalward from a corner and Sadio Mane nipped in front of Keylor Navas to poke home.
    Sesame Street sues 'explicit and profane' puppet movie The Happytime Murders

    Sesame Street sues 'explicit and profane' puppet movie The Happytime Murders

    Sesame Workshop seeks a permanent injunction on the use of its marks in connection with the marketing of The Happytime Murders . The Muppets have been a key part of " Sesame Street " since 1969.
  • Rockets battle Warriors in Game 6 of Western Conference finals

    Rockets battle Warriors in Game 6 of Western Conference finals

    We want to see your fan photos and videos! Paul did not even address the media post game because he was busy receiving treatment. The Warriors are hoping for the return of Andre Iguodala , who's missed the last two games, both losses, with a knee injury.
    LeBron Scores 46, Cavaliers Beat Celtics 109-99 To Force Game 7

    LeBron Scores 46, Cavaliers Beat Celtics 109-99 To Force Game 7

    That season, Boston knocked out James and the Cavs in six games in the second round, and James left the Cavs for the Miami Heat. George Hill added 20 points, while Jeff Green and Larry Nance came off the bench to deliver 14 and 10, respectively.

    Unusual wolf-like animal killed in Montana puzzles wildlife officials

    But others think it is a coywolf (a coyote wolf hybrid), or perhaps a wolfdog bred in captivity and later released into the wild. They are now relying on DNA tests to determine exactly what the species is.
  • Nipah Virus: How it spreads, symptoms and treatment of the infection

    Nipah Virus: How it spreads, symptoms and treatment of the infection

    This viral infection is classified as a zoonosis disease, indicating that it is transmitted via animals into the human system. Specifically, it is the Greater Indian Fruit Bat, found abundantly across South Asia, which carries the Nipah virus .
    Student says science teacher tackled Noblesville school shooter

    Student says science teacher tackled Noblesville school shooter

    He said he was conscious after the shooting and spoke with his wife, telling her he was OK. Police have reportedly confirmed that the families of the victims have been notified.
    US Reaches Deal to Keep Chinese Telecom ZTE in Business: Congressional Aide

    US Reaches Deal to Keep Chinese Telecom ZTE in Business: Congressional Aide

    The president's efforts to negotiate a deal with ZTE have been met with opposition from Democrats, as well as some Republicans. While such an agreement is viewed as a way to advance trade negotiations with China , lawmakers could be resistant to a deal.
  • Latest Liverpool target Nabil Fekir was linked with Everton back in 2015

    Latest Liverpool target Nabil Fekir was linked with Everton back in 2015

    Relegation was looming after a 2-0 loss to Everton left Liverpool only off the bottom of the Premier League on goal difference. The Liverpool boss continued to praise his players for the excellent campaign that has seen them arrive in the final.
    Moonwalking astronaut-artist Alan Bean dies at 86

    Moonwalking astronaut-artist Alan Bean dies at 86

    Alan Bean the fourth astronaut to walk on the moon before becoming a painter died Saturday at the age of 86 in Texas . We invite you to share condolences for Alan Bean in our Guest Book .

    Star Wars bounty hunter Boba Fett set for next spin-off movie

    With the Star Wars franchise showing no signs of stopping, there have been countless other spinoffs rumored to be in development . It'll be interesting to see what approach Mangold and Kinberg adopt if the solo outing comes to fruition.


Most liked

Man Utd agree £43.8 million transfer fee
Manchester City dropped out of the race for his signature last month, leaving Manchester United on pole position to sign him. The Man United boss wants to bring in Fred before the World Cup, so a deal could be signed and sealed in a matter of weeks.

Seoul: North Korea committed to US summit, denuclearization
Mr Trump welcomed the North's conciliatory response to his Thursday letter withdrawing from the Singapore summit with Kim Jong-un. The tweet comes after the historic summit was called into question when Mr Trump pulled out on Thursday after talks deteriorated.

What we learned vs. Boston Celtics Game 6
He'll have to come up clutch once again when they face the Celtics in Boston for Game 7 this Sunday. "We have no other way out". If The Machine can churn out one more game for the ages, he'll bring the Cavs home.

Venezuela has freed USA missionary Josh Holt, Trump says
Holt, 26, traveled to Caracas in June 2016 to marry a fellow Mormon he had met online while looking to improve his Spanish. Trump tweeted a second time Saturday, saying, "Looking forward to seeing Joshua Holt this evening in the White House".

Two injured in IN school shooting, suspect arrested
The suspect had excused himself from class at Noblesville West Middle School and came back armed with the pistols and opened fire. Sandy McWilliams, a member of a landscaping crew, said six officers with assault rifles entered a home.

Klopp calls for 'big balls' from Liverpool
Carvajal missed most of the semi-final through injury but is back in the side and will be in for a tough time up against Salah. Fox is included in the package so you'll be able to quickly join in time to watch the entire Liverpool vs Real Madrid game .

Ireland Votes To Overturn Abortion Ban by a Landslide - Lauretta Brown
The "Yes" campaign was backed by Ireland's Indian origin Prime Minister Leo Varadkar . Varadkar told RTE, Ireland's public broadcaster.

Cairney the hero as Fulham strike it rich with Premier League promotion
Between them, they gladly hoovered up danger and it was only Grealish, the dancing Villa playmaker who Fulham failed to mute. Aston Villa , meanwhile, is looking to return to the top flight after two seasons in the Championship .

US Mississippi, Florida Declare Emergency Over Subtropical Storm Alberto
Monday looks like the rainiest, windiest day with an increasing threat of some tornadoes east of wherever the center ends up. The last time a tropical cyclone was named Alberto was in 2012; it also formed before the season began, on May 19.

Explosive detonates in restaurant near Toronto, injures 15
Peel Regional paramedic Joe Korstanje told CBC that the three critically injured people had been taken to a nearby trauma center. Peel regional police tweeted that 2 suspects attended the scene, detonated an Improvised Explosive Device within the restaurant.

Trump not backing down on 'spy' allegations
Adam Schiff (D-Calif.), the top Democrat on the House Intelligence Committee, criticized as "completely inappropriate". That explanation has not satisfied many Democrats. "If the facts are against you, argue the law", the saying goes.

Meghan Markle’s Royal Coat of Arms Pays Homage to California
The Coats of Arms of members of the Royal Family are broadly similar to The Queen's with small differences to differentiate them. Kensington Palace released the coat of arms, incorporates strong symbolism drawing on Markle's life, Friday.

Gini Wijnaldum shows he gets Liverpool with approach to Champions League final
Salah marked his debut season at Liverpool by scoring 32 Premier League goals beating Ronaldo's 31-goal joint record from 2007-08.

Iran presses European Union on measures to salvage nuclear deal
Plan B has just started to be figured out". "European banks should safeguard trade with the Islamic Republic", Khamenei said. They have said that as long as Tehran meets its commitments, they will stick to the deal.

Liverpool v Real Madrid: James Milner stuns teammates with wondergoal in training
That would equal the individual record, and leave him in sight of yet another Ballon d'Or. In terms of history alone, this is a dream final.