andradar
play

AndRadar: Fast Discovery of Android Applications in Alternative - PowerPoint PPT Presentation

AndRadar: Fast Discovery of Android Applications in Alternative Markets Martina Lindorfer, Stamatis Volanis, Alessandro Sisto Matthias Neugschwandtner, Elias Athanasopoulos, Federico Maggi Christian Platzer, Sotiris


  1. 
 AndRadar: 
 Fast Discovery of Android Applications 
 in Alternative Markets 
 � Martina Lindorfer, Stamatis Volanis, Alessandro Sisto � Matthias Neugschwandtner, Elias Athanasopoulos, Federico Maggi � Christian Platzer, Sotiris Ioannidis, Stefano Zanero � � Vienna University of Technology � Foundation for Research & Technology – Hellas � Politecnico di Milano �

  2. ���� ���������������� ������������������� ����������������������� Low infection rates? � �������������������������� ���� ��� ���������������� ���� �������������� ����������� ���������������� ����������� ����� ��������������������� �������������������� ��������������������� ������ ���������������� ������������������ ��������������������� ������� ���������������������� ��������������� ������������������ ����������������� ���������������� ��� ��������������������� ���������������� Google: Android Security From The Ground Up (VirusBulletin 2013) � • The Core of the Matter (NDSS13) � 0.0009% � • The Company You Keep (WWW14) � 0.28% � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 1 �

  3. AV vendors paint a different picture… � TrendMicro TrendLabs 1Q 2014 Security Roundup � Fortinet 2014 Threat Landscape Report � McAfee Labs Threats Report June 2014 � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 2 �

  4. Motivation � • How are malicious apps distributed? � - Official Google Play Store � - Torrents, One-Click Hosters � - Websites, Blogs, … � - Alternative App Markets � � • How wide-spread are malicious apps, how often are they downloaded? � • Do alternative markets employ security measures? � • Collect metadata for malware analysis � - Andrubis, AndroTotal � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 3 �

  5. Market Metadata: Google Play � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 4 �

  6. Market Metadata: Google Play � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 5 �

  7. Outline � • Market Characterization � • Android Market Radar (AndRadar) � • Evaluation and Case Study � • Future Work and Conclusion � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 6 �

  8. Market Characterization � • Alternative markets are popular because of … � - Country gaps (e.g. no paid apps in Google Play China) � - Promotion � - Specific needs and specialization � • Preliminary study on 8 alternative marketplaces � - Crawled them entirely between July and Nov 2013 � - Downloaded 318,515 apps � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 7 �

  9. (1) Distribution of Unwanted Apps � Do markets distribute known, unwanted apps? � • Yes, they do! � • 5-8% malicious apps in whole dataset 
 10+ AV detections, excluding adware � • Some markets specialize in adware/”madware” 
 � Percentage of ad − /malware on market 8 Percentage of malware on market opera opera 60 andapponline andapponline camangi camangi 6 slideme slideme fdroid fdroid 40 blackmart blackmart getjar getjar 4 pandapp pandapp 20 2 0 0 10 20 30 10 20 30 Number of positive AV detections Number of positive AV detections Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 8 �

  10. (2) Publication of malicious apps � Do markets allow the publication of malicious apps? � • Yes, they do! � andapponline camangi opera pandaapp slideme • Ranking based on number 
 Malware Goodware 150 of published apps � • Well visible and known to 
 market operators � Number of apps published • Top authors publish both 
 100 benign and malicious apps � 50 0 1 2 3 4 5 1 2 3 4 5 1 2 3 4 5 1 2 3 4 5 1 2 3 4 5 Top 5 authors per market Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 9 �

  11. (3) Distinctive metadata � Do malicious apps have distinctive metadata? � • Yes, they do! � • Malicious apps slightly larger than goodware 
 à Additional malicious code in repackaged apps � • Malicious apps are downloaded more often 
 à Inflation of ranking with app rank boosting services � � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 10 �

  12. ������������ ������� ����� ������ ��������� �������� ������� ������ (4) Market Overlap � How are markets related to each other? � • Markets share up to 47% MD5s, 75% package names � ��������� ��������� 16% 16% 12% 12% ������ ������ 15% 15% ������������ ������������ 75% 75% ��� ��� 36% 36% 38% 38% ��� ��� 59% 59% 22% 22% 26% 26% 12% 12% 26% 26% 63% 63% ��� ��� 21% 21% 31% 31% ������ ������ 15% 15% ����� ����� 41% 41% 12% 12% 16% 16% 19% 19% ��� ��� 13% 13% 32% 32% ��� ��� ������� ������� �������� �������� 22% 22% ������� ������� Intersection by MD5 � Intersection by package name � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 11 �

  13. Outline � • Market Characterization � • Android Market Radar (AndRadar) � • Evaluation and Case Study � • Future Work and Conclusion � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 12 �

  14. AndRadar Design Goals � • Discover apps in markets in real-time � • Distribution of apps across markets � • Increasing space and time requirements � • Meta information dynamic à regular crawling of apps � • Crawling of complete markets becomes infeasible � - Plethora of alternative markets 
 ~ 196 in October 2011 (Vidas et al. CODASPY13) 
 ~ 500 in Juniper Threats Report March 2012/2013 
 ~ 89 in our market study in June 2013 � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 13 �

  15. AndRadar Architecture � Metadata Search Scraper Seed Tracker App Downloader Metadata Market Specifications Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 14 �

  16. App Discovery � • Lightweight identifier to select target apps � • Package name uniquely identifies app on device � • Package name identifies app in markets � • Part of an app’s “Branding” � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 15 �

  17. App Discover: AppChina � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 16 �

  18. App Discovery: Appszoom � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 17 �

  19. App Matching � • Match downloaded app to malicious app in seed � • Different levels of confidence based on � - Package name � - MD5 hash � - Fingerprint of developer’s certificate � - Method signatures � � a.b.c MD5 part of seed N N N fingerprint method signature MD5 match? weak match match? match? a.b.c MD5' Y Y Y from market strong match N strong match method signature perfect match different application repackaged version match? same application by same author Y very strong match different version by same author Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 18 �

  20. Collected Metadata � • Continuous monitoring of discovered apps � • Harvest meta information from market listing � - Upload date � - Description � - Screenshots � - Number of downloads � - User ratings � - Reviews � - Other apps by the same author � - Delete date � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 19 �

  21. Outline � • Market Characterization � • Android Market Radar (AndRadar) � • Evaluation and Case Study � • Future Work and Conclusion � Detection of Intrusions and Malware & Vulnerability Assessment, July 2014 � 20 �

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend