Static vs. Dynamic Analysis Static analysis: analyze source code or - PowerPoint PPT Presentation

I NTELLI D ROID A Targeted Input Generator for the Dynamic Analysis of Android Malware Michelle Y. Wong and David Lie University of Toronto Department of Electrical and Computer Engineering NDSS Symposium 2016

• ! ! ! B ACKGROUND Static vs. Dynamic Analysis • Static analysis: analyze source code or byte code ◦ Imprecise ◦ No run-time data • Dynamic analysis: analyze during execution ◦ Run-time values → precise I NTELLI D ROID 2 U NIVERSITY OF T ORONTO


 
 • ! ! ! B ACKGROUND Dynamic Code Coverage • To detect malicious activity, first have to execute it • Example: 
 message = <receive confirmation SMS> 
 if message.number == ‘1234’: <malicious action> I NTELLI D ROID 3 U NIVERSITY OF T ORONTO

• ! ! ! B ACKGROUND Concolic Testing • Run all execution paths in application • Symbolic execution, solve constraints for inputs constraint 1 constraint 1 !(constraint 1) !(constraint 1) constraint 2 !(constraint 2) constraint 3 !(constraint 3) I NTELLI D ROID 4 U NIVERSITY OF T ORONTO

• ! ! ! B ACKGROUND Specific Malicious Paths • Malicious activity only executed in certain parts of the code malicious code I NTELLI D ROID 5 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN IntelliDroid • Targets specific parts of the application ◦ Input generator for existing dynamic detector ◦ Hybrid static and dynamic design • Implemented for Android • Improve malware analysis and detection I NTELLI D ROID 6 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Target Malicious Paths • Malicious activity present only in certain parts of the code malicious code I NTELLI D ROID 7 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Target Malicious Paths • Use static analysis to look for call paths to malicious activity malicious code I NTELLI D ROID 8 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Target Over-Approximation • Target over-approximation of malicious behaviors suspicious suspicious suspicious code code code I NTELLI D ROID 9 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Target Over-Approximation • Target over-approximation of malicious behaviors suspicious suspicious suspicious code code code I NTELLI D ROID 10 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Targeted Methods • Use method invocations as over-approximation ◦ Depends on attached dynamic malware detector Dynamic Tool Goal Features for Analysis • Existing dynamic detectors 
 AASandbox [10] Monitor behavior via track- System calls ing of system calls Malware detection via sys- Low-level device fea- Andromaly [36] for Android: tem resource usage tures (e.g. battery us- age, CPU load) CopperDroid [39] Monitor behavior via sys- System calls tem call tracking Monitor behavior via track- System calls Crowdroid [12] ✔ ◦ Method invocations ing of system calls DroidBox [18] Sandbox to monitor exter- Sink API methods nal accesses DroidRanger [50] Detect malware using pre- Sequence of API specified behavioral foot- method invocations ✔ ◦ System call traces prints and heuristics and parameters DroidScope [39] Plugins for API track- API methods; ing, instruction tracing, and source/sink API taint tracking methods RiskRanker [39] Detect malware using Sequence of API ❌ ◦ Anomaly detection known vulnerability method invocations signatures Detect privacy leakage Source/sink API meth- TaintDroid [19] ods VetDroid [47] Malware detection via per- Permission requests mission use behavior (can be mapped to API methods) I NTELLI D ROID 11 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Static Constraint Extraction • Extract constraints on inputs that can trigger targeted paths Path Path Constraints Constraints Path Constraints suspicious code I NTELLI D ROID 12 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Targeted Input Injection • Inject constrained inputs to execute paths at run-time Static Dynamic Path inputs Constraints … Run-time inputs Path Constraints I NTELLI D ROID U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Challenges • Finding targeted paths using static analysis ◦ Imprecision? • Executing path to suspicious code ◦ Dependencies between paths? • Run-time input injection ◦ Where to inject? I NTELLI D ROID 14 U NIVERSITY OF T ORONTO


 
 ! • ! ! D ESIGN Static Imprecision • Static analysis cannot determine run-time values • Example: 
 message = <receive confirmation SMS> 
 if message.number == <file A>.text: <malicious action> Constraint <SMS message>.number == <file A> I NTELLI D ROID 15 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Using Run-time Data • Solve constraints at run-time (with run-time data) Static Dynamic Run-time Path 1 file A file A Constraints “1234” “1234” constraint … constraints … solver location location Path N San Diego San Diego Constraints <SMS message>.number == <file A> “1234” I NTELLI D ROID 16 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Path Dependencies • Data- and control-flow dependencies between call paths read X data flow malicious write X code I NTELLI D ROID 17 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Path Dependencies • Data- and control-flow dependencies between call paths 1 2 Event Chain read X 1) <path to write X> 2) <path to malicious code> malicious write X code I NTELLI D ROID 18 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Run-Time Injection Application Event SMS Event Handler Handler Handler Framework System SMS System Service Service Service Cellular Sensor Radio Hardware/Device I NTELLI D ROID 19 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Application Injection Application info on SMS? Event SMS Event Handler Handler Handler Framework what SMS? System SMS System Service Service Service Cellular Sensor Radio Hardware/Device I NTELLI D ROID 20 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Device-Framework Injection Application info on SMS? Event SMS Event Handler Handler Handler Framework OK! System SMS System Service Service Service Cellular Sensor Radio Hardware/Device I NTELLI D ROID 21 U NIVERSITY OF T ORONTO

! • ! ! D ESIGN Contributions • Static imprecision ◦ Dynamic constraint solving with run-time values • Path dependencies ◦ Event chains • Consistent input injection ◦ Device-framework injection I NTELLI D ROID 22 U NIVERSITY OF T ORONTO

! ! • ! I MPLEMENTATION Static Component Targeted App APK Application Behaviors BootReceiver onReceive(Intent i): if i == BOOT_COMPLETED: a = 1234 SMSReceiver IntelliDroid onReceive(Intent i): Static Component if i == SMS_RECEIVED: handleSMS(…) handleSMS(addr, msg): if a == addr: sendTextMessage(…) I NTELLI D ROID 23 U NIVERSITY OF T ORONTO

! ! • ! I MPLEMENTATION Static Component Targeted App APK Application Behaviors BootReceiver Extract event handlers onReceive(Intent i): if i == BOOT_COMPLETED: a = 1234 Find call paths SMSReceiver Extract path constraints onReceive(Intent i): 2 1 if i == SMS_RECEIVED: handleSMS(…) Add to event chain handleSMS(addr, msg): if a == addr: If dependency: sendTextMessage(…) find dependent path I NTELLI D ROID 24 U NIVERSITY OF T ORONTO

! ! • ! I MPLEMENTATION Static Component Targeted App APK Application Behaviors BootReceiver Extract event handlers onReceive(Intent i): 1 if i == BOOT_COMPLETED: a = 1234 Find call paths SMSReceiver Extract path constraints onReceive(Intent i): 2 if i == SMS_RECEIVED: handleSMS(…) Add to event chain handleSMS(addr, msg): if a == addr: If dependency: Output: target call 
 sendTextMessage(…) find dependent path paths and constraints I NTELLI D ROID 25 U NIVERSITY OF T ORONTO

! ! • ! I MPLEMENTATION Implementation • Static analysis (Android-specific): WALA 1 • Dynamic component: ◦ Client program (Python) Constraint solver: Z3 2 - ◦ Custom Android OS IntelliDroidService : system service to receive input - information and inject events 1 Watson libraries for analysis. http://wala.sourceforge.net. Accessed: September 2014. 2 Leonardo De Moura and Nikolaj Bjørner. Z3: An efficient SMT solver. In Tools and Algorithms for the Construction and Analysis of Systems, pages 337–340. Springer, 2008. I NTELLI D ROID 26 U NIVERSITY OF T ORONTO

! ! ! • E VALUATION Evaluation • Can IntelliDroid be integrated with existing dynamic malware detectors? • Can it execute targeted behaviours at run-time? • Is the analysis time reasonable? I NTELLI D ROID 27 U NIVERSITY OF T ORONTO

! ! ! • E VALUATION Integration with TaintDroid • Attached to TaintDroid (dynamic taint tracking tool) • Input generator to execute taint sources and sinks TaintDroid leakage IntelliDroid IntelliDroid paths inputs Dynamic paths (Static) (Dynamic) Detector taint source taint sink e.g. getDeviceId() sendTextMessage() I NTELLI D ROID 28 U NIVERSITY OF T ORONTO