Upload File

dissecting state-of-the-art android malware using static and dynamic analysis

  • Home
  • Technology
  • Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis
36
© Fraunhofer Partner in MALWARE ANALYSIS WITH CODEINSPECT Combating sophisticated Android malware

Upload: choose

Post on 12-Apr-2017

61 views

Category:

Technology


1 download

Report

TRANSCRIPT

Page 1: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

MALWARE ANALYSIS WITH CODEINSPECTCombating sophisticated Android malware

Page 2: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

AGENDA

Android Malware: Quo Vadis?

Dissecting Malware with CodeInspect

Advanced Static Analysis

Conclusions

Page 3: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Who Am I?

4th year PhD Student at TU Darmstadt Researcher at Fraunhofer SIT

Research interests: Static analysis IT security

Community service Reviewer for conferences & journals Maintainer of Soot and FlowDroid

Page 4: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

The Android Ecosystem

Developer User

Page 5: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

The Android Ecosystem (2)

vs.

Page 6: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Are Virus Scanners The Solution?

Signature 1Signature 2…Signature 3

Page 7: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

How Hard Can It Be?

Page 8: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Malware Evades Detection – Dynamic Analysis (1)

Timing Bombs Emulator Detection Country Targeting

IP Restrictions Provider Checking Integrity Checking

Page 9: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Malware Evades Detection – Dynamic Analysis (2)

Command-and-Control

UI Dependencies Logic Bombs

File Checking App Checking

Page 10: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Malware Evades Detection – Static Analysis

Packers Reflection Dynamic CodeLoading

Native Code Interpreters

Page 11: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

What Do You Have to Hide?

vs.

Page 12: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

First Takeaway Messages (1)

No practically usable analysis can be sound Over-approximate everywhere -> useless analysis

Real-world apps escape academic models quickly Use full language with reflection, etc. Mix of programming languages and libraries

Page 13: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

First Takeaway Messages (2)

Real-world constraints Large apps Immense volume of apps published or updated daily Minimum burden for developers and users Get new features out quickly Need good reasons to block apps or people out

Page 14: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Hybrid Analysis Approach

Static Analysis Dynamic Analysis

Analysis Information

Page 15: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

FuzzDroid (1)

Under which environment does the app execute the given API call?

Page 16: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

FuzzDroid (2)

Static Analysis Dynamic Analysis

Environment

Runtime Data

Page 17: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

FuzzDroid Evaluation

Locations

Apps

0 10 20 30 40 50 60 70 80

Launch Launch & Trigger FuzzDroid

Page 18: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Human in The Loop

Static Analysis Dynamic Analysis

Page 19: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Page 20: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

CodeInspect At A Glance (1)

• Based on Eclipse RCP

• Work as you would on source code in Eclipse• Navigate through the code• Add, change, and remove code• Inject arbitrary Java code• Start and debug your app• Inspect and change runtime values

Page 21: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

CodeInspect At A Glance (2)

Page 22: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

CodeInspect At A Glance (3)

• Sophisticated Static and Dynamic Analysis• Permission Use Analysis• Sensitive API Call Detection• Data Flow Tracking• Runtime Code Injection• App Communication Analysis

Page 23: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

public void foo() {

byte[] $arrbyte;java.io.FileOutputStream $FileOutputStream;…

specialinvoke this.<android.app.Service: void onCreate()>();

$File = new java.io.File;specialinvoke $File.<java.io.File: void <init>(java.lang.String)>("/sdcard/test.apk");specialinvoke $FileOutputStream.<java.io.FileOutputStream: void

<init>(java.io.File)>($File);

$arrbyte = newarray (byte)[1024];$int = virtualinvoke $InputStream.<java.io.InputStream: int read(byte[])>($arrbyte);…

The Jimple IR

Method Declaration

Variable Declarations

Implementation

Page 24: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Live Demo (1)

Page 25: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Live Demo (2)

Page 26: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Live Demo (3)

Page 27: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Live Demo Wrap-Up

1. Find interesting starting points External guidance (network sniff, etc.) Text search Manifest analysis: main activity, application class, etc. Permission uses

2. Debug the app for the details Circumvent environment checks (e.g., emulator) Step over reflective calls for free URLs, IP addresses, e-mail addresses, telephone numbers, etc.

Page 28: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Advanced Static Analysis: Permission Usage

Page 29: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Where is this called?

Page 30: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Investigating the SMS Message

Set breakpoints in onCreate() in sendSms()

Look at the path in between Conditions? Remote triggers? Runtime values?

Emulate necessary events Incoming SMS message, location change, etc.

Page 31: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Advanced Static Analysis: String Constants (1)

Page 32: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Advanced Static Analysis: String Constants (2)

Page 33: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Advanced Static Analysis: String Constants (3)

Look for common patterns http:// and https:// connections Telephone Numbers File paths (/sdcard/)

Case-specific patterns Bank names Country names Strings from SMS messages or e-mails

Page 34: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Advanced Static Analysis: Sensitive API Calls

Page 35: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

Conclusions

Android malware protected against Static analysis Dynamic analysis

Solution 1: Hybrid analyses FuzzDroid reconstructs environments

Solution 2: Aid the human analyst CodeInspect combines debugger, static, and dynamic analysis

Page 36: Dissecting State-of-the-Art Android Malware Using Static and Dynamic Analysis

© Fraunhofer Partner in

www.codeinspect.de

Free Demo Version Available!


CS155: Android Malware

Dissecting ZeuS malware

Dissecting Android Malware: Characterization and · PDF file · 2015-06-04•“Benign” game with a malvertisement 35 In-app ad pop-up Source: . Malware: Activation When do bad

Kharon dataset: Android malware under a microscope · Kharon dataset: Android malware under a microscope ... 1 Introduction Android malware have become a very active research

Demystifying Android Malware

Malware Detection in Android Applications

OFFENSIVE MALWARE ANALYSIS dissecting osx/fruitfly … Conf... · OFFENSIVE MALWARE ANALYSIS dissecting osx/fruitfly via a ... mouse/keyboard sniffer -Mac OS X Internals sniff sniff!

Dissecting Android Malware : Characterization and Evolution

Android bankosy malware iicybersecurity

Final Android Malware(2007)

Android Malware Detection via (Somewhat) Robust

Android Malware Exposed - Webroot · An In-depth Look at the Evolution of Android Malware Android Security ... We will discuss the tools used for analysis along ... “Android Malware

SMARTPHONE (ANDROID) MALWARE

Dissecting Android Wear

Enhancing Accuracy of Android Malware Detection using Intent …sharif.edu/~amini/publications/conferences/2017/Malware... · 2017-10-01 · Keywords: Android Security, Malware Detection,

Dissecting Android Malware : Characterization and Evolution Author : Yajin Zhou, Xuxuan Jiang TJ

Android malware analysis

AVTOKYO2012 Android Malware Heuristics(en)

Building Custom Android Malware BruCON 2013

Android Malware and Analysis - Oscardunkelheit.com.br/android/forense/curso/curso/[Ken... · In Android Malware and Analysis, Ken Dunham, renowned global malware expert and author,

Dissecting Derusbi - RSA Conference · Dissecting Derusbi. HTA-W02. ... Multistage malware Dropper Downloader Backdoors. #RSAC Malware. 7 Sakula Shyape Derusbi Hikit Plugx PoisonIvy

Android Malware Detection using Complex-Flows

Android Malware Development on Public Malware Scanning ...sxz16/papers/bigdata2016.pdf · Android Malware Development on Public Malware Scanning Platforms: A Large-scale Data-driven

Dissecting the Hack: Malware Analysis 101

AVPASS: Automatically Bypassing Android Malware Detection

Rat malware android

MALWARE PARA DISPOSITIVOS MÓVILES (ANDROID) · aplicaciones en el mercado oficial de Android, con la aparición de este malware aparece una nueva era de malware para Android. Robo

ANDROID MALWARE ACTS AS AN SMS RELAY - Trend …la.trendmicro.com/media/misc/spotlight-android-malware-acts-as-sms... · 2 Threat Spotlight Android Malware Acts as an SMS Relay: Just

Mobile Threats 2013: Android Malware & Vulnerabilities

OFFENSIVE MALWARE ANALYSIS dissecting osx/fruitfly via a ... CON 25/DEF CON 25 presentations/DE… · OFFENSIVE MALWARE ANALYSIS dissecting osx/fruitfly via a custom c&c server.

1 Detection of Repackaged Android Malware with Code ...people.cs.vt.edu/danfeng/papers/Repackaged-Malware-Android-IEEE … · Detection of Repackaged Android Malware with Code-Heterogeneity

Android triada malware iicybersecurity

Android Malware Past, Present, and Future · White Paper Android Malware—Past, Present, and Future Table of Contents Executive Summary 3 Introduction 3 The History of Android Malware

ANDROID BANKING MALWARE · android banking malware: sophisticated trojans vs. fake banking apps android banking malware white paper // author: lukáš Štefanko tlp: white

Fidelis Threat Advisory #1020 Dissecting the Malware