Botconf Author Listing

Oren Koriat

Last known affiliation: Kovrr
Bio: Oren is a mobile-malware and threat-intelligence analyst and researcher. He’s an expert on the threat landscape of Asian mobile markets, and the author of many of Check Point’s publications on mobile malware
Date: 2017-12-06
Hunting Down Gooligan
Elie Bursztein 🗣 | Oren Koriat 🗣

Abstract (click to view)

This talk provides a retrospective on how during 2017 Check Point and Google jointly hunted down Gooligan – one of the largest Android botnets at the time. Beside its scale what makes Gooligan a worthwhile case-study is its heavy reliance on stolen oauth tokens to attack Google Play’s API, an approach previously unheard of in malware.

This talk starts by providing an in-depth analysis of how Gooligan’s kill-chain works from infection and exploitation to system-wide compromise. Then building on various telemetry we will shed light on which devices were infected and how this botnet attempted to monetize the stolen oauth tokens. Next we will discuss how we were able to uncover the Gooligan infrastructure and how we were able to tie it to another prominent malware family: Ghostpush. Last but not least we will recount how we went about re-securing the affected users and takedown the infrastructure.

Scroll to Top