com.wsomacp Copy

Labelled "Configuration message" on every device in this sample, this is the Samsung component that receives and applies OMA CP messages. OMA CP is Open Mobile Alliance Client Provisioning, an industry standard for deploying network settings to mobile devices over the air; Check Point's research write up dates the standard to 2001 with its latest specification in 2009, and describes the messages as arriving over WAP Push, a binary SMS delivered to port 2948. The same write up sets out what such a message can change: MMS servers, proxy addresses, browser homepage and bookmarks, mail servers and directory servers for contact and calendar synchronisation. It has no launcher entry in any observation here, so nothing a user opens; it acts on messages the network sends. The permissions it declares, as recorded on this site, line up with that description rather than adding to it: RECEIVE_WAP_PUSH and BROADCAST_WAP_PUSH, RECEIVE_SMS, WRITE_APN_SETTINGS, and Samsung-defined permissions for the browser homepage and bookmarks and for the Samsung email provider. It is signed by a Samsung OEM key that also signs the Android framework. Its security history is the reason it is worth knowing about. Check Point reported in 2019 that Samsung devices accepted unauthenticated OMA CP messages, so an attacker who could send one needed only the user's acceptance to point the device at a proxy of their choosing. Samsung's own security bulletin records the fix as SVE-2019-14073, "Potential Phishing Flow in OMACP", in the Security Maintenance Release for May 2019, described there as a vulnerability allowing a manipulated OMACP message to change the network and internet settings on the device. So Samsung reported the issue fixed in May 2019; nothing here establishes that every device in the field received that release, and older or unpatched builds may remain affected. Either way, the point that carries forward is that this package is the component through which operator-pushed network configuration reaches the device. Version note: Samsung's own Common Criteria application lists record the same package under the same label on the Galaxy Note9 (the Oreo-era N960N list, at 7.1.13) and the Galaxy S20 (the R-era G981U list, at 7.4.07). Devices on this site report versions 7.5.02 to 9.2.08, observed from API 28 through API 37 and targeting API 30 to 36, and only on Samsung hardware. It is therefore long-standing and still maintained. Beyond the 2019 authentication fix, no source establishes a change in its role across Android releases, and none is implied by the data here. For Android Enterprise, EMM and kiosk use, the relevance is that this is the on-device path by which APN and proxy settings can be altered from outside the management channel, which is usually the configuration an administrator has deliberately fixed. The documented controls sit in policy rather than in the package: the Android Management API exposes mobileNetworksConfigDisabled, "Whether configuring mobile networks is disabled", and smsDisabled, "Whether sending and receiving SMS messages is disabled". Where the package itself needs to go, Samsung documents blocking a named preinstalled system app through Knox Manage's application policies rather than stripping it. The rating below is caution rather than safe because on a device that still depends on the operator to push its APN or MMS settings, removing the component that applies them can leave data or messaging misconfigured; on a fixed-configuration kiosk where the EMM supplies the APN, there is much less to lose. Test on one device before applying it to a fleet.

• Advanced SMS Phishing Attacks Against Modern Android-based Smartphones - Check Point Research →
• Samsung Security Maintenance Release, May 2019 (SVE-2019-14073, Potential Phishing Flow in OMACP) →
• Galaxy Note9 (N960N) application list - Samsung Knox CC Mode documentation →
• Galaxy S20 5G (G981U) application list - Samsung Knox CC Mode documentation →
• Policy resource reference (mobileNetworksConfigDisabled, smsDisabled) - Android Management API →
• Enable or disable a specific system app - Knox Manage - Samsung Knox Documentation →
• Package provenance for com.wsomacp - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 19 permissions: 4 runtime (user-granted), 4 signature or system-level, 4 install-time and 7 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.