Google Online Security Blog: Detecting and eliminating Chamois, a fraud botnet on Android

Security Blog

The latest news and insights from Google on security and safety on the Internet

Detecting and eliminating Chamois, a fraud botnet on Android

March 13, 2017

Posted by Security Software Engineers—Bernhard Grill, Megan Ruthven, and Xin Zhao

Potentially Harmful Applications

Generating invalid traffic through ad pop ups having deceptive graphics inside the ad

Performing artificial app promotion by automatically installing apps in the background

Performing telephony fraud by sending premium text messages

Downloading and executing additional plugins

Interference with the ads ecosystem

We detected Chamois during a routine ad traffic quality evaluation. We analyzed malicious apps based on Chamois, and found that they employed several methods to avoid detection and tried to trick users into clicking ads by displaying deceptive graphics. This sometimes resulted in downloading of other apps that commit SMS fraud. So we blocked the Chamois app family using Verify Apps and also kicked out bad actors who were trying to game our ad systems.

Verify Apps

Under Chamois's hood

Chamois was one of the largest PHA families seen on Android to date and distributed through multiple channels. To the best of our knowledge Google is the first to publicly identify and track Chamois.

Multi-staged payload: Its code is executed in 4 distinct stages using different file formats, as outlined in this diagram.

Self-protection: Chamois tried to evade detection using obfuscation and anti-analysis techniques, but our systems were able to counter them and detect the apps accordingly.

Custom encrypted storage: The family uses a custom, encrypted file storage for its configuration files and additional code that required deeper analysis to understand the PHA.

Size: Our security teams sifted through more than 100K lines of sophisticated code written by seemingly professional developers. Due to the sheer size of the APK, it took some time to understand Chamois in detail.

Google's approach to fighting PHAs

Verify Apps protects users from known PHAs by warning them when they are downloading an app that is determined to be a PHA, and it also enables users to uninstall the app if it has already been installed. Additionally, Verify Apps monitors the state of the Android ecosystem for anomalies and investigates the ones that it finds. It also helps finding unknown PHAs through behavior analysis on devices. For example, many apps downloaded by Chamois were highly ranked by the DOI scorer. We have implemented rules in Verify Apps to protect users against Chamois.