Android devices ship with pre-installed malware: Avast
Avast Threat Labs has found adware pre-installed on several hundred different Android device models and versions.
According to a new report by global cybersecurity leader Avast, several hundred different Android device models and versions, including devices from ZTE and Archos have pre-installed adware. The adware, known as "Cosiloon", creates an overlay to display an ad over a webpage within the users' browser. The majority of these devices are not certified by Google.
A blog post by the Avast Threat Labs says that the adware creates an overlay to display an ad over a webpage within the users' browser. The adware has been active for at least three years, and is difficult to remove as it is installed on the firmware level and uses strong obfuscation, said the report by Avast Threat Labs.
Thousands of users are affected, and in the past month alone the company has seen the latest version of the adware on around 18,000 devices belonging to Avast users located in more than 100 countries including Russia, Italy, Germany, the UK, as well as some users in the U.S, the company told in a blog post.
The company says that they are in touch with Google and they are aware of the issue. Google has taken steps to mitigate the malicious capabilities of many app variants on several device models, using internally developed techniques. Google Play Protect has been updated to ensure there is coverage for these apps in the future.
However, as the apps come pre-installed with the firmware, the problem is difficult to address. Google has reached out to the firmware developers to bring awareness to these concerns and encouraged them to take steps to address the issue.
"Some anti-virus apps report the payloads, but the dropper will install them right back again and the dropper itself can't be removed, so the device will forever have a method allowing an unknown party to install any application they want on it," the report informed.
Google News