More Than 1 Million Android Devices Rooted By Gooligan Malware

Reader Trailrunner7 writes: A new version of an existing piece of malware has emerged in some third-party Android app stores and researchers say it has infected more than a million devices around the world, giving the attackers full access to victims' Google accounts in the process. The malware campaign, known as Gooligan, is a variant of older malware called Ghost Push that has been found in many malicious apps. Researchers at Check Point recently discovered several dozen apps, mainly in third-party app stores, that contain the malware, which is designed to download and install other apps and generate income for the attackers through click fraud. The malware uses phantom clicks on ads to generate revenue for the attackers through pay-per-install schemes, but that's not the main concern for victims. The Gooligan malware also employs exploits that take advantage of several known vulnerabilities in older versions of Android, including Kit Kat and Lollipop to install a rootlet that is capable of stealing users' Google credentials.Although the malware has full remote access to infected devices, it doesn't appear to be stealing user data, but rather is content to go the click-fraud route. Most users are being infected through the installation of apps that appear to be legitimate but contain the Gooligan code, a familiar infection routine for mobile devices.

Gooligan Malware?

[Anonymous Coward]

I'd rather download Ginger or Mary Ann malware.

Re:

[Anonymous Coward]

That type of malware takes half of everything you own.

Re:

[dywolf]

you forgot the best choice of all: the billionaire's wife.
(or the billionaire, depending on your proclivities)

Re:Gooligan Malware?

[Rob Y.]

He was a 'millionaire', not a 'billionaire'. Boy, a million bucks sure isn't what it used to be...

Re:

[Anonymous Coward]

Certain links if you have turned off the default security setting that only allows apps to come from the trusted store sure. And even the summary says none of these came from the Play Store. So - people attempting to pirate $1.99 apps or people foolish enough to use the Amazon app store which also requires you to turn off the security setting. Yes, cheapskates. Normal users have nothing to worry about here.

Which is why Google should control Android updates

[cellocgw]

Here I sit w/ my beloved Asus ME302C, complete abandonware for over 3 years now. Everything runs fine, it can handle all updated apps, browsers, Chromecast, and so on. Just no way, other than convoluted roothacking and Cyanogen installation, to update the Android OS itself.

Can I sue Asus for this? (rhetorical question)

Re:

[Blaskowicz]

A cheap Windows tablet with about the same hardware would do about the job with a decade of updates, me think. But Windows is free as beer for 7.9 inches and under, is that it? As if a dealer pushing one free serving of dope.

Re:

[Blaskowicz]

Wow. Crap.
Asus is a long-renowned motherboard vendor, a major PC vendor and I somehow thought they would know a bit about support. They know things about firmware and user-facing documentation and downloads. It's no surprise the Android crap division doesn't support their products, I guess everyone may know it by inquiring a little on the internets but if Asus won't support their hardware, who will with their own? It's like a tragedy of commons, not quite the right term but I wonder how you should call it,

While we're on the subject: Android Ant-malware

[Rick Schumann]

I don't have or want a smartphone, but I have a friend who recently had to get one (so he didn't end up with a shitty phone with a screen too small to read) and it's Android; I see there is at least one anti-malware solution out there for Android phones, but knowing little-to-nothing about Android, could I please get suggestions for an effective anti-malware solution for Android phones? Thanks.

Re:While we're on the subject: Android Ant-malware

[silverkniveshotmail.]

Don't sideload apps from shady websites, stick to the playstore. If your friend was somehow forced to buy a smartphone there's nothing forcing him to install any additional apps.

Re:

[BasilBrush]

But muh android freedumz...

Re:

[Rick Schumann]

That's the one that I've seen so far, thanks for that (you're more helpful that the idiots who commented above you), but I'd like more than one choice to evaluate before I make my own recommendation to my friend.

Re:

[jrumney]

an effective anti-malware solution for Android phones?

Hell, I'd settle for an effective anti-malware solution for Windows. Is that industry good for anything other than making your hardware feel like it has aged 20 years.

Biology 101

[Solandri]

Although the malware has full remote access to infected devices, it doesn't appear to be stealing user data, but rather is content to go the click-fraud route.

Successful parasites do not kill their host - if they do that, they have to find another host. The successful ones minimize their impact on the host, using them as a free ride [wikipedia.org] to other opportunities which they can exploit. Sometimes this even develops into a symbiotic relationship.

If the malware doesn't steal user data, the user has no incentive to detect and remove it. Much to the consternation of the ad networks which are the real targets. I wouldn't be surprised if the next step is for this malware to install patches to fix vulnerabilities in the OS, to prevent other less well-thought-out malware from being installed and eventually getting the frustrated user to wipe and reset the phone.

Re:

[silverkniveshotmail.]

There may be other symptoms like terrible battery life, excessive data usage and poor performance.

Re:

[Blaskowicz]

With higher specs - 1GB on the low/mid end, better flash, better OS (maybe) and some lightweight enough malware, perhaps the performance won't be so poor. We used to have excruciatingly slow Windows XP computers loaded with malware (funny, given how a clean Windows XP on mid 2000s vintage computer is really fast), and we now have quick running Windows 7 computers with some background malware (that isn't always that clever, as search page hijacking etc. gives it away)

The malware could stay off 3G/4G and stea

Re:

[rodrigoandrade]

A good malware programmer will make his app invisible to the naive end user, avoiding battery and performance hits on the device, so they'll never know the app is running.

Just sit right back and you'll hear a tale

[Muntzsky]

A tale of a malware app
That exposed Google accountholders
Using Android smartphone crap.

Tool to verify if you've been hacked

[rodrigoandrade]

https://gooligan.checkpoint.com/

You're welcome.

What does 'mainly' mean

[Tangential]

The post says "Researchers at Check Point recently discovered several dozen apps, mainly in third-party app stores, that contain the malware".

Does that mean there are some apps infected with this in the Google app store as well?