Are these Ads Safe: Detec/ng Hidden A4acks through Mobile App-Web - - PowerPoint PPT Presentation

▶
are these ads safe detec ng hidden a4acks through mobile
SMART_READER_LITE
LIVE PREVIEW

Are these Ads Safe: Detec/ng Hidden A4acks through Mobile App-Web - - PowerPoint PPT Presentation

Feb 24, 2024 170 likes •485 views

Are these Ads Safe: Detec/ng Hidden A4acks through Mobile App-Web Interfaces Vaibhav Rastogi 1 , Rui Shao 2 , Yan Chen 3 , Xiang Pan 3 , Shihong Zou 4 , and Ryan Riley 5 1 University of Wisconsin and Pennsylvania State University 2 Zhejiang

slide-1
SLIDE 1

Are these Ads Safe: Detec/ng Hidden A4acks through Mobile App-Web Interfaces

Vaibhav Rastogi1, Rui Shao2, Yan Chen3, Xiang Pan3, Shihong Zou4, and Ryan Riley5

1 University of Wisconsin and Pennsylvania State University 2 Zhejiang University 3 Northwestern University 4 Beijing University of Posts and TelecommunicaJons 5 Qatar University

slide-2
SLIDE 2

Consider This…

2

slide-3
SLIDE 3

Consider This…

3

slide-4
SLIDE 4

The Problem

  • Enormous effort toward analyzing malicious

applicaJons

  • App may itself be benign
  • But may lead to malicious content through links
  • App-web interface
  • Links inside the app leading to web-content
  • Not well-explored
  • Types
  • AdverJsements
  • Other links in app

4

slide-5
SLIDE 5

Outline

App-Web Interface CharacterisJcs SoluJon Results Conclusion

5

slide-6
SLIDE 6

Outline

App-Web Interface CharacterisJcs SoluJon Results Conclusion

6

slide-7
SLIDE 7

App-Web Interface Characteris/cs

  • Can be highly dynamic
  • A link may recursively redirect to another before

leading to a final web page

  • Links embedded in apps
  • Can be dynamically generated
  • Can lead to dynamic websites
  • AdverJsements
  • Ad libraries create links dynamically
  • Ad economics can lead to complex redirecJon chains

7

slide-8
SLIDE 8

Adver/sing Overview

8

slide-9
SLIDE 9

Ad Networks

  • Ad libraries act as the interface between apps and

ad network servers

  • Ad networks may interface with each other
  • SyndicaJon – One network asks another to fill

ad space

  • Ad exchange – Real-Jme aucJon of ad space
  • App or original ad network may not have control on

ads served

9

slide-10
SLIDE 10

Outline

App-Web Interface CharacterisJcs SoluJon Results Conclusion

10

slide-11
SLIDE 11

Solu/on Components

  • Triggering: Interact with app to launch web links
  • Detec*on: Process the results to idenJfy malicious

content

  • Provenance: IdenJfy the origin of a detected

malicious acJvity

  • A_ribute malicious content to domains and ad networks

11

slide-12
SLIDE 12

Solu/on Architecture

12

slide-13
SLIDE 13

Triggering

  • Use AppsPlayground1
  • A gray box tool for app UI

exploraJon

  • Extracts features from displayed UI

and iteraJvely generates a UI model

  • A novel computer graphics-based

algorithm for idenJfying bu_ons

  • See widgets and bu_ons as a

human would

13

1Rastogi, Vaibhav, Yan Chen, and William Enck. "AppsPlayground: automaJc security analysis of smartphone applicaJons.”

In Proceedings of the third ACM conference on Data and applica6on security and privacy, pp. 209-220. ACM, 2013.

slide-14
SLIDE 14

Detec/on

  • AutomaJcally

download content from landing pages

  • Use VirusTotal for

detecJng malicious files and URLs

14

slide-15
SLIDE 15

Provenance

  • How did the user come

across an a_ack?

  • Code-level a_ribuJon
  • App code
  • Ad libraries
  • Iden*fied 201 ad libraries
  • RedirecJon chain-level

a_ribuJon

  • Which URLs led to a_ack

page or content

15

slide-16
SLIDE 16

Outline

App-Web Interface CharacterisJcs SoluJon Results Conclusion

16

slide-17
SLIDE 17

Results

  • Deployments in US and China
  • 600 K apps from Google Play and Chinese stores
  • 1.4 M app-web links triggered
  • 2,423 malicious URLs
  • 706 malicious files

17

slide-18
SLIDE 18

Case Study: Fake AV Scam

  • MulJple apps, one ad

network: Tapcontext

  • Ad network solely

serving this scam campaign

  • Phishing webpages

detected by Google and

  • ther URL blacklists

about 20 days aier we detected first instance

18

slide-19
SLIDE 19

Case Study: Free iPad Scam

  • Asked to give personal

informaJon without any return

  • New email address

receiving spam ever since

  • Origins at Mobclix and

Tapfortap

  • Ad exchanges
  • Neither developers nor

the primary ad networks likely aware of this

19

slide-20
SLIDE 20

Case Study: iPad Scam from sta/c link

  • Another Scam, this

Jme through a staJc link embedded in app

  • Link target opens in

browser and redirects to scam

  • Not affiliated with

Facebook

20

slide-21
SLIDE 21

Case Study: SMS Trojan Video Player

  • Ad from nobot.co.jp

leads to download a movie player

  • Player sends SMS

messages to a premium number without user consent

21

Click on ad

slide-22
SLIDE 22

Outline

App-Web Interface CharacterisJcs SoluJon Results Conclusion

22

slide-23
SLIDE 23

Limita/ons

  • Incomplete detecJon
  • AnJviruses and URL blacklists are not perfect
  • Our work DroidChameleon2 shows this
  • Incomplete triggering
  • App UI can be very complex
  • May sJll be sufficient to capture adverJsements

23 2Rastogi, Vaibhav, Yan Chen, and Xuxian Jiang. "Catch me if you can: EvaluaJng

android anJ-malware against transformaJon a_acks." Informa6on Forensics and Security, IEEE Transac6ons on 9.1 (2014): 99-108.

slide-24
SLIDE 24

Conclusion

  • Benign apps can lead to malicious content
  • Provenance makes it possible to idenJfy

responsible parJes

  • Can provide a safer landscape for users
  • Screening offending applicaJons
  • Holding ad networks accountable for content
  • Working with CNCERT to improve the situaJon

24

slide-25
SLIDE 25

Future Work

  • Speeding up collecJon of ads
  • Goals of analyzing an order of magnitude more ads

in shorter Jme

25

slide-26
SLIDE 26

SoOware and Dataset

  • Dataset of 201 ad libraries:

h_p://bit.ly/adlibset

  • New release of AppsPlayground:

h_p://bit.ly/appsplayground

26

slide-27
SLIDE 27

Thank you!

27

slide-28
SLIDE 28

Backup

28

slide-29
SLIDE 29

Related Work

  • Web MalverJsing
  • Other ad security and Privacy
  • UI exploraJon
  • Malware analysis and detecJon

29

slide-30
SLIDE 30

Comparison with Web Malver/sing

  • Focus on mobile applicaJons
  • Triggering component for web malverJsing is trivial
  • Different malware propagaJon mechanisms: drive-

by-downloads vs. trojans

30