SlideShare une entreprise Scribd logo

Android malware overview, status and dilemmas

•
•
Tech and Law Center
Tech and Law Center

Android Malware: Overview, Status and Dilemmas

Technologie
1  sur  76
Télécharger pour lire hors ligne
Malicious Android Apps Overview, Status and Dilemmas
1,260 Samples Analyzed (2012) Manual analysis of samples by Yajin Zhou & Xuxian Jiang 36.7% leverage root-level exploits 90% turn devices into bots 45.3% dial/text premium numbers in background 51.1% harvest user information Other goods encrypted root-level exploit or obfuscated C&C address
Attackers Goals Steal Sensitive Data intercept texts or calls steal passwords Turn Devices Into Bots perform malicious actions gain root privileges Direct Financial Gain call or text premium numbers steal online banking credentials
ZitMo & SpitMo (2011) ● Companion of the famous ZeuS and SpyEye trojans. ● Steal the mTAN or SMS used for 2-factor authentication.
The attack scheme (1) www.yourbank.com username: user password: ************ INFECTED COMPUTER er *** : us ******* me rna ord: ** use sw pas $$ $$ $ $$ $ $ $$ $$
2-factors authentication (password + secret code) ONE TIME SECRET CODE ************ GO!
The attack scheme (2) www.yourbank.com username: user password: ************ ONE TIME SECRET CODE INFECTED COMPUTER TYPE IN THE ONE TIME SECRET CODE OK EXPIRED TYPE IN THE ONE TIME SECRET CODE
The attack scheme (2) www.yourbank.com username: user password: ************ INFECTED COMPUTER inject QR code
Luring Users with a QR Code USERNAME user PASSWORD ************ SCAN TO LOGIN Login
The attack scheme (3) www.evil.org/fake-login-app.apk
The attack scheme (4) www.yourbank.com username: user password: ************ ONE TIME SECRET CODE INFECTED COMPUTER INFECTED SMARTPHONE TYPE IN THE ONE TIME SECRET CODE OK
The attack scheme (5) FINANCIAL TRANSACTIONS $$$$$$$ ALERT THE MALWARE HIDES SMSs FROM THE BANK
Perkele (2013) ● Sold for $1,000 on underground markets/forums ● Development kit for bypassing 2-factor authentication
Better than Perkele Hand of Thief kit (Android port, late 2013) $950
http://www.lacoon.com/hand-of-thief-hot-moves-its-way-to-android/
M VE A H ST U Retrospective of Predictions E! ID SL Source (Trend Micro, Q2 2012)
M VE A H ST U Prediction vs. Actual Data Number of Android malware samples E! ID SL Q4 2012 120,000 Source (Symantec, October 2013)
The Origin: TapSnake (2010)
Malware Distribution Google Play Store. Alternative markets. Underground affiliate programs (growing business).
Alternative Markets (91) Andapponline Aptoide Soc.io 92Apk T Store Cisco Market SlideMe Insydemarket Android Downloadz AppChina Yandex App Store Lenovo App Store AndroidPit PandaApp MerkaMarket CoolApk Pdassi Omnitel Apps AppsZoom AppsEgg Good Ereader Anzhi Market iMedicalApps TIM Store ApkSuite AppTown Mobile9 EOE Market Barnes & Noble T-Store Opera App Store AppBrain Phoload HiApk Nvidia TegraZone T-Market Brothersoft AppsLib Androidblip Nduoa AppCake AT&T Camangi ESDN 1Mobile Baidu App Store Handmark CNET Blackmart Alpha Mobilism Brophone D.cn Appolicious F-Droid Mob.org LG World Gfan Appitalism Android games room Amazon Handango Samsung App Store Millet App Store WhiteApp AndroLib Mikandi Handster Taobao AppCity GetJar Nexva market AppsFire Tencent App Gem AlternativeTo Tablified Market Yet Another Android Market Mobango Hyper Market Appzil AndroidTapp No Crappy Apps Naver NStore Fetch Moborobo 91mobiles mobiles24 Android Freeware MplayIt Hami Olleh Market wandoujia
DroidDream (2011) - Host Apps Falling Down Super Guitar Solo Super History Eraser Photo Editor Super Ringtone Maker Super Sex Positions Chess Hilton Sex Sound Screaming Sexy Japanese Girls Falling Ball Dodge Scientific Calculator Dice Roller
DroidDream (2011) - Info Stealing Steals C&C http://184.105.245.17:8080/GMServer/GMServlet IMEI IMSI exploid root-level exploit. device model SDK version Copy of the original public exploit! language country
DroidDream (2011) - More Details Downloads 2nd payload. Encrypts C&C messages. Installs payload under /system No icon nor installed application is visible to the user. zHash uses the same exploit.
DroidDreamLight (2011) ● Massive code refactoring. ● No root exploit. ● Steal same data. ● Receives remote updates. ● Affected 30–120k users. Image source (Trend Micro)
What the Malware! Source (Symantec, October 2013)
(our measurement, Nov 2013)
(our measurement, Nov 2013)
Plankton (2011) ● Update only some components. ● Silent update, no user participation. ● Payload hosted on Amazon. ● Inspired the AnserverBot family.
Plankton (2011) Silent update (first family) Command & Control: Image source (Sophos)
Countermeasures Google Play app vetting Install and permission confirmation SMS/call blacklisting and quota App verify (call home when apps are installed - incl. 3rd party) ● App sandboxing ● SELinux in enforcing mode (Android 4.4) ● AV apps ● ● ● ●
Blacklist & SMS Limits CyanogenMod >=10.2 Blacklist numbers 50 SMS per 30 minute limit
App Sandboxing User1 User2 User3 App1 App2 App3 Virtual machine Virtual machine Virtual machine Process1 Process2 Process3 ... ... PERMISSIONS Linux kernel
Apps Must Declare Permissions User1 User2 User3 App1 Malicious App App2 App3 Virtual machine Virtual machine Virtual machine Process1 Process2 Process3 ... ... PERMISSIONS Linux kernel
Permission Declaration
Selective Permissions Introduced in 4.3. Users can selectively filter permissions. That's great!
Google claimed its release was accidental Removed it in 4.4
Perms: Malware Goodware vs. Source: Y. Zhou and X. Jiang, “Dissecting Android Malware: Characterization and Evolution,” in Proceedings of the 33rd IEEE Symposium on Security and Privacy, 2012, pp. 95–109.
No primitives for process auditing User1 User2 User3 App1 Malicious App ... ANTIVIRUS APP Virtual machine Process1 ... PERMISSIONS Linux kernel Malicious App SD card
Workarounds (back in the '80s) Signature-based matching (evaded by repackaging). Scan (limited) portion of the storage. Send sample to cloud service (malware can sniff network). Custom kernel (not market proof).
TGLoader (2012) - Root 'n text No permissions. Root the phone. Loads 3 malicious APKs. Premium texting. C&C communication. Exploid root exploit
Asroot (2011) Simple, standalone app. Uses asroot root exploit. Not really widespread.
Malware Apps on Google Play 2010 (2) TapSnake, SMSReplicator 2011 (13) DroidDream, zHash, DroidDreamLight, Zsone, Plankton YZHC, SndApps, Zitmo, Asroot, Gone60, DroidKungFu (2)
App Verify Source: A. Ludwig, E. Davis, and J. Larimer, “Android - Practical Security From the Ground Up,” in Virus Bulletin Conference, 2013.
Countermeasures and Downsides Google Play app vetting Few apps made it through it Permission confirmation Unaware users SMS/call blacklisting and Must know the numbers quota Must know the malware App verify Root exploits + ask App sandboxing permissions
Application Signing ● No PKI ○ Apps signed with self-signed certs ○ AppIntegrity proposes a lightweight, neat solution ● Signature not checked at runtime ○ Can add new code at runtime and break the signature ● MasterKey vulnerability (CVE-2013-4787,
Exploited by Adr/MstrKey-A ● ...as well as Skullkey ● Signed-unsigned integer values vulnerability (Jul 2013)
BaseBridge (2011) ● Asset file hides the payload. ● Register to lots of events. ● Gains root privileges via RATC exploit. ○ spawn RLIMIT_NPROC-1 processes ○ kill adbd ○ spawn 1 process to race against adbd setuid()-ing ● Steals data (e.g., IMEI) + premium texts.
BaseBridge (2011) Source: Y. Zhou and X. Jiang, “Dissecting Android Malware: Characterization and Evolution,” in Proceedings of the 33rd IEEE Symposium
Academic Measurements 2010–October 2011 [Zhou et al., 2012] 49 families 20–76% detection rate October 2011 [Vidas et al., 2013] 194 markets facilitate malware distribution 0–32% detection rate (I don't really buy
Our Measurements 2–8% of the apps are known malware (Jun-Nov 2013)
Our Measurements 10–20% of the apps are known adware (Jun-Nov 2013)
CarrierIQ (2011) - Not Really Malware 140M devices including Sprint, HTC, Samsung. Controversial app used for enhancing "customer experience". Log keystrokes. Record calls. Store text messages. Track location.
Fake CarrierIQ Detector :-) Detects CarrierIQ. It actually finds IQ if is there. Premium texter malware. http://www.symantec.com/connect/blogs/day-afteryear-mobile-malware
Find if IQ services are installed. Tries to send premium SMSs (notice the nested try-catch).
RootSmart (2012) ● 2nd malware w/ GingerBreak exploit (1st was GingerMaster) ● Asks lots of permissions (suspicious ones) ○ MOUNT_UNMOUNT_FILESYSTEMS ○ RECEIVE_BOOT_COMPLETED ○ CHANGE_WIFI_STATE ● Suspicious broadcast receiver ○ NEW_OUTGOING_CALL ● Fetches the exploit from obfuscated URL
Friendly Marketplaces Top 5 authors publish both goodware and known malware.
Moghava (2012) - Annoying No monetary gain. Protest intended. Yet, very annoying. http://www.symantec. com/connect/blogs/androidmoghava-recipe-mayhem
LuckyCat (2012) - Used in APT 1st known used in APT. SMS initiated: "[...] time to renew data plan [...]" URL with WebKit exploit (this is drive-by!) Track user GPS, steal data. Naïvely encrypted C&C communication. http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_adding-android-and-mac-
Chuli (2012) - Again, in APT High-profile Tibetan activist email hacked. Used to send malicious APK to other activists. Steals data (SMS, contacts, IMEI, GPS, etc). https://www.securelist.com/en/blog/208194186/Android_Trojan_Found_in_Targeted_Attack
Registration Service Provided By: SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO., LTD. Domain Name: DLMDOCUMENTSEXCHANGE.COM Registration Date: 08-Mar-2013 Expiration Date: 08-Mar-2014 Status:LOCKED The domain registration data indicates the following owner: Registrant Contact Details: peng jia (bdoufwke123010@gmail.com) beijingshiahiidienquc.d beijingshi beijing,100000 CN Tel. +86.01078456689 Fax. +86.01078456689
Obad (2013) - Sophisticated Raises the bar. Could propagate via Bluetooth and WiFi. First emulator-aware malware. Anti dynamic analysis (corrupted XML) Anti static analysis (packed instr. + anti decompiling + encrypted strings) Gains device administration rights to hides itself.
Corrupted XML No attribute names. Accepted by smartphones. Makes sandboxes fail.
Bogus Instructions Targets specifically the dedexer disassembler. Prevents automatic repackaging of dex for analysis. Needed manual intervention. http://joe4mobile.blogspot.com/2013/06/analyzing-obada-aka-most-sophisticated.html
Anti Decompiling
Device Admin Privs Used to administer devices. http://www.comodo. com/resources/Android_OBAD_Tech_Reportv3.pdf Fool the user. http://developer.android. com/guide/topics/admin/device-admin.html
Baseline Features Steal data. Remote update. Execute shell commands. C&C communication (hardcoded...).
Mouabad (2013) - Sneaky Dialer Works when device goes to lock mode. Stops working right away when the user unlocks the device. Calls premium numbers located in China. No sophisticated anti-analysis techniques.
Stels (2013) - Spreads via Botnet Spreads through Cutwail botnet via spam emails. Vulnerable website to drop PHP script. PHP script fingerprints the client. Malicious (non-sophisticated) APK if browser == Android. Steals the usual data. http://www.secureworks.com/cyber-threat-intelligence/threats/stels-android-trojan-malware-analysis/
How Many Infected Devices? Damballa & GaTech DNS traffic analysis (2012) Mobile devices (0.0009%) 3,492 of 380,537,128 Kindsight Security Lab Mobile devices 0.50% (Q1) 0.52% (Q2) Android devices 1.00% (Q2)
Conclusions ● Many infected apps (hundreds of thousands) ● Low infection rate (0.0009–1.0%) ○ Wide range of uncertainty ○ The ROI per infected device must be high! ● Authors have just started to show what they can do.
http://andrototal.org @andrototal_org

Recommandé

Android malware analysis
Android malware analysisAndroid malware analysis
Android malware analysisJason Ross
 
Android malware presentation
Android malware presentationAndroid malware presentation
Android malware presentationSandeep Joshi
 
Android Malware Detection Mechanisms
Android Malware Detection MechanismsAndroid Malware Detection Mechanisms
Android Malware Detection MechanismsTalha Kabakus
 
Malware Detection in Android Applications
Malware Detection in Android ApplicationsMalware Detection in Android Applications
Malware Detection in Android Applicationsijtsrd
 
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...IOSR Journals
 
IRJET- Android Malware Detection System
IRJET- Android Malware Detection SystemIRJET- Android Malware Detection System
IRJET- Android Malware Detection SystemIRJET Journal
 
Android mobile platform security and malware survey
Android mobile platform security and malware surveyAndroid mobile platform security and malware survey
Android mobile platform security and malware surveyeSAT Journals
 
Tech Report: On the Effectiveness of Malware Protection on Android
Tech Report: On the Effectiveness of Malware Protection on AndroidTech Report: On the Effectiveness of Malware Protection on Android
Tech Report: On the Effectiveness of Malware Protection on AndroidFraunhofer AISEC
 

Recommandé

Android malware analysis
Android malware analysisAndroid malware analysis
Android malware analysisJason Ross
 
Android malware presentation
Android malware presentationAndroid malware presentation
Android malware presentationSandeep Joshi
 
Android Malware Detection Mechanisms
Android Malware Detection MechanismsAndroid Malware Detection Mechanisms
Android Malware Detection MechanismsTalha Kabakus
 
Malware Detection in Android Applications
Malware Detection in Android ApplicationsMalware Detection in Android Applications
Malware Detection in Android Applicationsijtsrd
 
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...
Android Malware: Study and analysis of malware for privacy leak in ad-hoc net...IOSR Journals
 
IRJET- Android Malware Detection System
IRJET- Android Malware Detection SystemIRJET- Android Malware Detection System
IRJET- Android Malware Detection SystemIRJET Journal
 
Android mobile platform security and malware survey
Android mobile platform security and malware surveyAndroid mobile platform security and malware survey
Android mobile platform security and malware surveyeSAT Journals
 
Tech Report: On the Effectiveness of Malware Protection on Android
Tech Report: On the Effectiveness of Malware Protection on AndroidTech Report: On the Effectiveness of Malware Protection on Android
Tech Report: On the Effectiveness of Malware Protection on AndroidFraunhofer AISEC
 
[Wroclaw #1] Android Security Workshop
[Wroclaw #1] Android Security Workshop[Wroclaw #1] Android Security Workshop
[Wroclaw #1] Android Security WorkshopOWASP
 
Android security
Android securityAndroid security
Android securityMobile Rtpl
 
Android Security & Penetration Testing
Android Security & Penetration TestingAndroid Security & Penetration Testing
Android Security & Penetration TestingSubho Halder
 
Sperasoft talks: Android Security Threats
Sperasoft talks: Android Security ThreatsSperasoft talks: Android Security Threats
Sperasoft talks: Android Security ThreatsSperasoft
 
Introduction to Android Development and Security
Introduction to Android Development and SecurityIntroduction to Android Development and Security
Introduction to Android Development and SecurityKelwin Yang
 
Android security
Android securityAndroid security
Android securityMidhun P Gopi
 
"Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения...
"Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения..."Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения...
"Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения...Yandex
 
Android Security
Android SecurityAndroid Security
Android SecuritySuminda Gunawardhana
 
Mobile Application Pentest [Fast-Track]
Mobile Application Pentest [Fast-Track]Mobile Application Pentest [Fast-Track]
Mobile Application Pentest [Fast-Track]Prathan Phongthiproek
 
Deepfake anyone, the ai synthetic media industry enters a dangerous phase
Deepfake anyone, the ai synthetic media industry enters a dangerous phaseDeepfake anyone, the ai synthetic media industry enters a dangerous phase
Deepfake anyone, the ai synthetic media industry enters a dangerous phaseaditi agarwal
 
Deep Dive Into Android Security
Deep Dive Into Android SecurityDeep Dive Into Android Security
Deep Dive Into Android SecurityMarakana Inc.
 
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...IJNSA Journal
 
Testing Android Security Codemotion Amsterdam edition
Testing Android Security Codemotion Amsterdam editionTesting Android Security Codemotion Amsterdam edition
Testing Android Security Codemotion Amsterdam editionJose Manuel Ortega Candel
 
Analysis and research of system security based on android
Analysis and research of system security based on androidAnalysis and research of system security based on android
Analysis and research of system security based on androidRavishankar Kumar
 
Android Security
Android SecurityAndroid Security
Android SecurityArqum Ahmad
 
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.com
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.comMobile Application Security Testing, Testing for Mobility App | www.idexcel.com
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.comIdexcel Technologies
 
Android security in depth
Android security in depthAndroid security in depth
Android security in depthSander Alberink
 
Security testing of mobile applications
Security testing of mobile applicationsSecurity testing of mobile applications
Security testing of mobile applicationsGTestClub
 
Android Security
Android SecurityAndroid Security
Android SecurityLars Jacobs
 
We explain the security flaw that's freaking out the internet
We explain the security flaw that's freaking out the internetWe explain the security flaw that's freaking out the internet
We explain the security flaw that's freaking out the internetaditi agarwal
 
Android Malware Analysis
Android Malware AnalysisAndroid Malware Analysis
Android Malware AnalysisJongWon Kim
 
Semantics aware malware detection ppt
Semantics aware malware detection pptSemantics aware malware detection ppt
Semantics aware malware detection pptManish Yadav
 

Contenu connexe

Tendances

[Wroclaw #1] Android Security Workshop
[Wroclaw #1] Android Security Workshop[Wroclaw #1] Android Security Workshop
[Wroclaw #1] Android Security WorkshopOWASP
 
Android security
Android securityAndroid security
Android securityMobile Rtpl
 
Android Security & Penetration Testing
Android Security & Penetration TestingAndroid Security & Penetration Testing
Android Security & Penetration TestingSubho Halder
 
Sperasoft talks: Android Security Threats
Sperasoft talks: Android Security ThreatsSperasoft talks: Android Security Threats
Sperasoft talks: Android Security ThreatsSperasoft
 
Introduction to Android Development and Security
Introduction to Android Development and SecurityIntroduction to Android Development and Security
Introduction to Android Development and SecurityKelwin Yang
 
"Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения...
"Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения..."Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения...
"Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения...Yandex
 
Mobile Application Pentest [Fast-Track]
Mobile Application Pentest [Fast-Track]Mobile Application Pentest [Fast-Track]
Mobile Application Pentest [Fast-Track]Prathan Phongthiproek
 
Deepfake anyone, the ai synthetic media industry enters a dangerous phase
Deepfake anyone, the ai synthetic media industry enters a dangerous phaseDeepfake anyone, the ai synthetic media industry enters a dangerous phase
Deepfake anyone, the ai synthetic media industry enters a dangerous phaseaditi agarwal
 
Deep Dive Into Android Security
Deep Dive Into Android SecurityDeep Dive Into Android Security
Deep Dive Into Android SecurityMarakana Inc.
 
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...IJNSA Journal
 
Testing Android Security Codemotion Amsterdam edition
Testing Android Security Codemotion Amsterdam editionTesting Android Security Codemotion Amsterdam edition
Testing Android Security Codemotion Amsterdam editionJose Manuel Ortega Candel
 
Analysis and research of system security based on android
Analysis and research of system security based on androidAnalysis and research of system security based on android
Analysis and research of system security based on androidRavishankar Kumar
 
Android Security
Android SecurityAndroid Security
Android SecurityArqum Ahmad
 
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.com
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.comMobile Application Security Testing, Testing for Mobility App | www.idexcel.com
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.comIdexcel Technologies
 
Android security in depth
Android security in depthAndroid security in depth
Android security in depthSander Alberink
 
Security testing of mobile applications
Security testing of mobile applicationsSecurity testing of mobile applications
Security testing of mobile applicationsGTestClub
 
Android Security
Android SecurityAndroid Security
Android SecurityLars Jacobs
 
We explain the security flaw that's freaking out the internet
We explain the security flaw that's freaking out the internetWe explain the security flaw that's freaking out the internet
We explain the security flaw that's freaking out the internetaditi agarwal
 

Tendances (20)

[Wroclaw #1] Android Security Workshop
[Wroclaw #1] Android Security Workshop[Wroclaw #1] Android Security Workshop
[Wroclaw #1] Android Security Workshop
 
Android security
Android securityAndroid security
Android security
 
Android Security & Penetration Testing
Android Security & Penetration TestingAndroid Security & Penetration Testing
Android Security & Penetration Testing
 
Sperasoft talks: Android Security Threats
Sperasoft talks: Android Security ThreatsSperasoft talks: Android Security Threats
Sperasoft talks: Android Security Threats
 
Introduction to Android Development and Security
Introduction to Android Development and SecurityIntroduction to Android Development and Security
Introduction to Android Development and Security
 
Android security
Android securityAndroid security
Android security
 
"Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения...
"Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения..."Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения...
"Быстрое обнаружение вредоносного ПО для Android с помощью машинного обучения...
 
Android Security
Android SecurityAndroid Security
Android Security
 
Mobile Application Pentest [Fast-Track]
Mobile Application Pentest [Fast-Track]Mobile Application Pentest [Fast-Track]
Mobile Application Pentest [Fast-Track]
 
Deepfake anyone, the ai synthetic media industry enters a dangerous phase
Deepfake anyone, the ai synthetic media industry enters a dangerous phaseDeepfake anyone, the ai synthetic media industry enters a dangerous phase
Deepfake anyone, the ai synthetic media industry enters a dangerous phase
 
Deep Dive Into Android Security
Deep Dive Into Android SecurityDeep Dive Into Android Security
Deep Dive Into Android Security
 
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
SYSTEM CALL DEPENDENCE GRAPH BASED BEHAVIOR DECOMPOSITION OF ANDROID APPLICAT...
 
Testing Android Security Codemotion Amsterdam edition
Testing Android Security Codemotion Amsterdam editionTesting Android Security Codemotion Amsterdam edition
Testing Android Security Codemotion Amsterdam edition
 
Analysis and research of system security based on android
Analysis and research of system security based on androidAnalysis and research of system security based on android
Analysis and research of system security based on android
 
Android Security
Android SecurityAndroid Security
Android Security
 
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.com
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.comMobile Application Security Testing, Testing for Mobility App | www.idexcel.com
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.com
 
Android security in depth
Android security in depthAndroid security in depth
Android security in depth
 
Security testing of mobile applications
Security testing of mobile applicationsSecurity testing of mobile applications
Security testing of mobile applications
 
Android Security
Android SecurityAndroid Security
Android Security
 
We explain the security flaw that's freaking out the internet
We explain the security flaw that's freaking out the internetWe explain the security flaw that's freaking out the internet
We explain the security flaw that's freaking out the internet
 

En vedette

Android Malware Analysis
Android Malware AnalysisAndroid Malware Analysis
Android Malware AnalysisJongWon Kim
 
Semantics aware malware detection ppt
Semantics aware malware detection pptSemantics aware malware detection ppt
Semantics aware malware detection pptManish Yadav
 
AVTOKYO2012 Android Malware Heuristics(en)
AVTOKYO2012 Android Malware Heuristics(en)AVTOKYO2012 Android Malware Heuristics(en)
AVTOKYO2012 Android Malware Heuristics(en)雅太 西田
 
Malware by Ms. Allwood
Malware by Ms. AllwoodMalware by Ms. Allwood
Malware by Ms. AllwoodStavia
 
Android village @nullcon 2012
Android village @nullcon 2012 Android village @nullcon 2012
Android village @nullcon 2012 hakersinfo
 
It Security For Healthcare
It Security For HealthcareIt Security For Healthcare
It Security For HealthcareNicholas Davis
 
2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing
2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing
2013 Toorcon San Diego Building Custom Android Malware for Penetration TestingStephan Chenette
 
Экспресс-анализ вредоносов / Crowdsourced Malware Triage
Экспресс-анализ вредоносов / Crowdsourced Malware TriageЭкспресс-анализ вредоносов / Crowdsourced Malware Triage
Экспресс-анализ вредоносов / Crowdsourced Malware TriagePositive Hack Days
 
Максим Ширшин — Регулярные выражения
Максим Ширшин — Регулярные выраженияМаксим Ширшин — Регулярные выражения
Максим Ширшин — Регулярные выраженияYandex
 
Template ppt Android Menarik
Template ppt Android MenarikTemplate ppt Android Menarik
Template ppt Android MenarikSaeful Bahri
 
Введение в SEO
Введение в SEOВведение в SEO
Введение в SEOROOKEE
 
Тенденции российского рынка ИБ
Тенденции российского рынка ИБТенденции российского рынка ИБ
Тенденции российского рынка ИБAleksey Lukatskiy
 
Как защититься рядовому пользователю от динамично меняющих угроз?
Как защититься рядовому пользователю от динамично меняющих угроз?Как защититься рядовому пользователю от динамично меняющих угроз?
Как защититься рядовому пользователю от динамично меняющих угроз?Aleksey Lukatskiy
 
Крупные мероприятия по информационной безопасности на 2017 год
Крупные мероприятия по информационной безопасности на 2017 годКрупные мероприятия по информационной безопасности на 2017 год
Крупные мероприятия по информационной безопасности на 2017 годAleksey Lukatskiy
 

En vedette (20)

Android Malware Analysis
Android Malware AnalysisAndroid Malware Analysis
Android Malware Analysis
 
Semantics aware malware detection ppt
Semantics aware malware detection pptSemantics aware malware detection ppt
Semantics aware malware detection ppt
 
AVTOKYO2012 Android Malware Heuristics(en)
AVTOKYO2012 Android Malware Heuristics(en)AVTOKYO2012 Android Malware Heuristics(en)
AVTOKYO2012 Android Malware Heuristics(en)
 
PPT_Compiled
PPT_CompiledPPT_Compiled
PPT_Compiled
 
Malware by Ms. Allwood
Malware by Ms. AllwoodMalware by Ms. Allwood
Malware by Ms. Allwood
 
Android village @nullcon 2012
Android village @nullcon 2012 Android village @nullcon 2012
Android village @nullcon 2012
 
It Security For Healthcare
It Security For HealthcareIt Security For Healthcare
It Security For Healthcare
 
2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing
2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing
2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing
 
Кратко про тенденции ИБ к обсуждению (Код ИБ)
Кратко про тенденции ИБ к обсуждению (Код ИБ)Кратко про тенденции ИБ к обсуждению (Код ИБ)
Кратко про тенденции ИБ к обсуждению (Код ИБ)
 
Tesina Sobri
Tesina SobriTesina Sobri
Tesina Sobri
 
Про практику DLP (Код ИБ)
Про практику DLP (Код ИБ)Про практику DLP (Код ИБ)
Про практику DLP (Код ИБ)
 
Экспресс-анализ вредоносов / Crowdsourced Malware Triage
Экспресс-анализ вредоносов / Crowdsourced Malware TriageЭкспресс-анализ вредоносов / Crowdsourced Malware Triage
Экспресс-анализ вредоносов / Crowdsourced Malware Triage
 
Максим Ширшин — Регулярные выражения
Максим Ширшин — Регулярные выраженияМаксим Ширшин — Регулярные выражения
Максим Ширшин — Регулярные выражения
 
Template ppt Android Menarik
Template ppt Android MenarikTemplate ppt Android Menarik
Template ppt Android Menarik
 
Выживший
ВыжившийВыживший
Выживший
 
Введение в SEO
Введение в SEOВведение в SEO
Введение в SEO
 
Introduction To SELinux
Introduction To SELinuxIntroduction To SELinux
Introduction To SELinux
 
Тенденции российского рынка ИБ
Тенденции российского рынка ИБТенденции российского рынка ИБ
Тенденции российского рынка ИБ
 
Как защититься рядовому пользователю от динамично меняющих угроз?
Как защититься рядовому пользователю от динамично меняющих угроз?Как защититься рядовому пользователю от динамично меняющих угроз?
Как защититься рядовому пользователю от динамично меняющих угроз?
 
Крупные мероприятия по информационной безопасности на 2017 год
Крупные мероприятия по информационной безопасности на 2017 годКрупные мероприятия по информационной безопасности на 2017 год
Крупные мероприятия по информационной безопасности на 2017 год
 

Similaire à Android malware overview, status and dilemmas

I haz you and pwn your maal whitepaper
I haz you and pwn your maal whitepaperI haz you and pwn your maal whitepaper
I haz you and pwn your maal whitepaperHarsimran Walia
 
Mobile security
Mobile securityMobile security
Mobile securityStefaan
 
Mobile Malwares Analysis - Garvit Arya
Mobile Malwares Analysis - Garvit AryaMobile Malwares Analysis - Garvit Arya
Mobile Malwares Analysis - Garvit AryaGarvit Arya
 
Mobile application security
Mobile application securityMobile application security
Mobile application securityEY Belgium
 
A tale of mobile threats
A tale of mobile threatsA tale of mobile threats
A tale of mobile threatsVincenzo Iozzo
 
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...Denis Gorchakov
 
Android– forensics and security testing
Android– forensics and security testingAndroid– forensics and security testing
Android– forensics and security testingSanthosh Kumar
 
Droidcon2013 security genes_trendmicro
Droidcon2013 security genes_trendmicroDroidcon2013 security genes_trendmicro
Droidcon2013 security genes_trendmicroDroidcon Berlin
 
Review on mobile threats and detection techniques
Review on mobile threats and detection techniquesReview on mobile threats and detection techniques
Review on mobile threats and detection techniquesijdpsjournal
 
A Study on Modern Methods for Detecting Mobile Malware
A Study on Modern Methods for Detecting Mobile MalwareA Study on Modern Methods for Detecting Mobile Malware
A Study on Modern Methods for Detecting Mobile MalwareIRJET Journal
 
Anomaly Detection using String Analysis for Android Malware Detection - CISIS...
Anomaly Detection using String Analysis for Android Malware Detection - CISIS...Anomaly Detection using String Analysis for Android Malware Detection - CISIS...
Anomaly Detection using String Analysis for Android Malware Detection - CISIS...Carlos Laorden
 
Top mobile security threats
Top mobile security threatsTop mobile security threats
Top mobile security threatsRingtoIndia
 
Outsmarting smartphones
Outsmarting smartphonesOutsmarting smartphones
Outsmarting smartphonesSensePost
 
Malware in Mobile Platform from Panoramic Industrial View
Malware in Mobile Platform from Panoramic Industrial ViewMalware in Mobile Platform from Panoramic Industrial View
Malware in Mobile Platform from Panoramic Industrial ViewAntiy Labs
 

Similaire à Android malware overview, status and dilemmas (20)

I haz you and pwn your maal whitepaper
I haz you and pwn your maal whitepaperI haz you and pwn your maal whitepaper
I haz you and pwn your maal whitepaper
 
Android security
Android security Android security
Android security
 
Security News bytes October 2013
Security News bytes October 2013Security News bytes October 2013
Security News bytes October 2013
 
Mobile security
Mobile securityMobile security
Mobile security
 
Mobile Malwares Analysis - Garvit Arya
Mobile Malwares Analysis - Garvit AryaMobile Malwares Analysis - Garvit Arya
Mobile Malwares Analysis - Garvit Arya
 
Mbs w23
Mbs w23Mbs w23
Mbs w23
 
Mobile application security
Mobile application securityMobile application security
Mobile application security
 
A tale of mobile threats
A tale of mobile threatsA tale of mobile threats
A tale of mobile threats
 
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
 
Rp threat-predictions-2013
Rp threat-predictions-2013Rp threat-predictions-2013
Rp threat-predictions-2013
 
Android– forensics and security testing
Android– forensics and security testingAndroid– forensics and security testing
Android– forensics and security testing
 
Droidcon2013 security genes_trendmicro
Droidcon2013 security genes_trendmicroDroidcon2013 security genes_trendmicro
Droidcon2013 security genes_trendmicro
 
Review on mobile threats and detection techniques
Review on mobile threats and detection techniquesReview on mobile threats and detection techniques
Review on mobile threats and detection techniques
 
A Study on Modern Methods for Detecting Mobile Malware
A Study on Modern Methods for Detecting Mobile MalwareA Study on Modern Methods for Detecting Mobile Malware
A Study on Modern Methods for Detecting Mobile Malware
 
HinDroid
HinDroidHinDroid
HinDroid
 
Anomaly Detection using String Analysis for Android Malware Detection - CISIS...
Anomaly Detection using String Analysis for Android Malware Detection - CISIS...Anomaly Detection using String Analysis for Android Malware Detection - CISIS...
Anomaly Detection using String Analysis for Android Malware Detection - CISIS...
 
Mobile Malware
Mobile MalwareMobile Malware
Mobile Malware
 
Top mobile security threats
Top mobile security threatsTop mobile security threats
Top mobile security threats
 
Outsmarting smartphones
Outsmarting smartphonesOutsmarting smartphones
Outsmarting smartphones
 
Malware in Mobile Platform from Panoramic Industrial View
Malware in Mobile Platform from Panoramic Industrial ViewMalware in Mobile Platform from Panoramic Industrial View
Malware in Mobile Platform from Panoramic Industrial View
 

Plus de Tech and Law Center

One step further in the surveillance society the case of predictive policing
One step further in the surveillance society the case of predictive policingOne step further in the surveillance society the case of predictive policing
One step further in the surveillance society the case of predictive policingTech and Law Center
 
2015.11.06. Luca Melette_Mobile threats evolution
2015.11.06. Luca Melette_Mobile threats evolution2015.11.06. Luca Melette_Mobile threats evolution
2015.11.06. Luca Melette_Mobile threats evolutionTech and Law Center
 
Andrea Molino: Applicazione delle tecnologie ICT al settore Agricolo
Andrea Molino: Applicazione delle tecnologie ICT al settore AgricoloAndrea Molino: Applicazione delle tecnologie ICT al settore Agricolo
Andrea Molino: Applicazione delle tecnologie ICT al settore AgricoloTech and Law Center
 
Emanuela Pala: Internet of Things & Smart Agriculture
Emanuela Pala: Internet of Things & Smart Agriculture Emanuela Pala: Internet of Things & Smart Agriculture
Emanuela Pala: Internet of Things & Smart Agriculture Tech and Law Center
 
Tommaso De Gregorio: Growing Hazelnuts
Tommaso De Gregorio: Growing Hazelnuts Tommaso De Gregorio: Growing Hazelnuts
Tommaso De Gregorio: Growing Hazelnuts Tech and Law Center
 
Gillian Cafiero - "Codifying the Harm of Cybercrime": Injecting zemiology in ...
Gillian Cafiero - "Codifying the Harm of Cybercrime": Injecting zemiology in ...Gillian Cafiero - "Codifying the Harm of Cybercrime": Injecting zemiology in ...
Gillian Cafiero - "Codifying the Harm of Cybercrime": Injecting zemiology in ...Tech and Law Center
 
Cybersecurity & Digital Forensics / Dronitaly - 25 Ottobre 2014
Cybersecurity & Digital Forensics / Dronitaly - 25 Ottobre 2014Cybersecurity & Digital Forensics / Dronitaly - 25 Ottobre 2014
Cybersecurity & Digital Forensics / Dronitaly - 25 Ottobre 2014Tech and Law Center
 
Giuseppe Vaciago: From Crime to privacy-oriented crime prevention in the Big ...
Giuseppe Vaciago: From Crime to privacy-oriented crime prevention in the Big ...Giuseppe Vaciago: From Crime to privacy-oriented crime prevention in the Big ...
Giuseppe Vaciago: From Crime to privacy-oriented crime prevention in the Big ...Tech and Law Center
 
SECURITY OF THE DIGITAL NATIVES - Italian version
SECURITY OF THE DIGITAL NATIVES - Italian versionSECURITY OF THE DIGITAL NATIVES - Italian version
SECURITY OF THE DIGITAL NATIVES - Italian versionTech and Law Center
 
SECURITY OF THE DIGITAL NATIVES - English version
SECURITY OF THE DIGITAL NATIVES - English versionSECURITY OF THE DIGITAL NATIVES - English version
SECURITY OF THE DIGITAL NATIVES - English versionTech and Law Center
 
Cybercrime, Digital Investigation and Public Private Partnership by Francesca...
Cybercrime, Digital Investigation and Public Private Partnership by Francesca...Cybercrime, Digital Investigation and Public Private Partnership by Francesca...
Cybercrime, Digital Investigation and Public Private Partnership by Francesca...Tech and Law Center
 
Digital Native Privacy (Francesca Bosco & Giuseppe Vaciago)
Digital Native Privacy (Francesca Bosco & Giuseppe Vaciago)Digital Native Privacy (Francesca Bosco & Giuseppe Vaciago)
Digital Native Privacy (Francesca Bosco & Giuseppe Vaciago)Tech and Law Center
 
The Death Of Computer Forensics: Digital Forensics After the Singularity
The Death Of Computer Forensics: Digital Forensics After the SingularityThe Death Of Computer Forensics: Digital Forensics After the Singularity
The Death Of Computer Forensics: Digital Forensics After the SingularityTech and Law Center
 
Legal Aspect of the Cloud by Giuseppe Vaciago
Legal Aspect of the Cloud by Giuseppe VaciagoLegal Aspect of the Cloud by Giuseppe Vaciago
Legal Aspect of the Cloud by Giuseppe VaciagoTech and Law Center
 

Plus de Tech and Law Center (15)

One step further in the surveillance society the case of predictive policing
One step further in the surveillance society the case of predictive policingOne step further in the surveillance society the case of predictive policing
One step further in the surveillance society the case of predictive policing
 
2015.11.06. Luca Melette_Mobile threats evolution
2015.11.06. Luca Melette_Mobile threats evolution2015.11.06. Luca Melette_Mobile threats evolution
2015.11.06. Luca Melette_Mobile threats evolution
 
Andrea Molino: Applicazione delle tecnologie ICT al settore Agricolo
Andrea Molino: Applicazione delle tecnologie ICT al settore AgricoloAndrea Molino: Applicazione delle tecnologie ICT al settore Agricolo
Andrea Molino: Applicazione delle tecnologie ICT al settore Agricolo
 
Emanuela Pala: Internet of Things & Smart Agriculture
Emanuela Pala: Internet of Things & Smart Agriculture Emanuela Pala: Internet of Things & Smart Agriculture
Emanuela Pala: Internet of Things & Smart Agriculture
 
Tommaso De Gregorio: Growing Hazelnuts
Tommaso De Gregorio: Growing Hazelnuts Tommaso De Gregorio: Growing Hazelnuts
Tommaso De Gregorio: Growing Hazelnuts
 
Smart intelligence
Smart intelligenceSmart intelligence
Smart intelligence
 
Gillian Cafiero - "Codifying the Harm of Cybercrime": Injecting zemiology in ...
Gillian Cafiero - "Codifying the Harm of Cybercrime": Injecting zemiology in ...Gillian Cafiero - "Codifying the Harm of Cybercrime": Injecting zemiology in ...
Gillian Cafiero - "Codifying the Harm of Cybercrime": Injecting zemiology in ...
 
Cybersecurity & Digital Forensics / Dronitaly - 25 Ottobre 2014
Cybersecurity & Digital Forensics / Dronitaly - 25 Ottobre 2014Cybersecurity & Digital Forensics / Dronitaly - 25 Ottobre 2014
Cybersecurity & Digital Forensics / Dronitaly - 25 Ottobre 2014
 
Giuseppe Vaciago: From Crime to privacy-oriented crime prevention in the Big ...
Giuseppe Vaciago: From Crime to privacy-oriented crime prevention in the Big ...Giuseppe Vaciago: From Crime to privacy-oriented crime prevention in the Big ...
Giuseppe Vaciago: From Crime to privacy-oriented crime prevention in the Big ...
 
SECURITY OF THE DIGITAL NATIVES - Italian version
SECURITY OF THE DIGITAL NATIVES - Italian versionSECURITY OF THE DIGITAL NATIVES - Italian version
SECURITY OF THE DIGITAL NATIVES - Italian version
 
SECURITY OF THE DIGITAL NATIVES - English version
SECURITY OF THE DIGITAL NATIVES - English versionSECURITY OF THE DIGITAL NATIVES - English version
SECURITY OF THE DIGITAL NATIVES - English version
 
Cybercrime, Digital Investigation and Public Private Partnership by Francesca...
Cybercrime, Digital Investigation and Public Private Partnership by Francesca...Cybercrime, Digital Investigation and Public Private Partnership by Francesca...
Cybercrime, Digital Investigation and Public Private Partnership by Francesca...
 
Digital Native Privacy (Francesca Bosco & Giuseppe Vaciago)
Digital Native Privacy (Francesca Bosco & Giuseppe Vaciago)Digital Native Privacy (Francesca Bosco & Giuseppe Vaciago)
Digital Native Privacy (Francesca Bosco & Giuseppe Vaciago)
 
The Death Of Computer Forensics: Digital Forensics After the Singularity
The Death Of Computer Forensics: Digital Forensics After the SingularityThe Death Of Computer Forensics: Digital Forensics After the Singularity
The Death Of Computer Forensics: Digital Forensics After the Singularity
 
Legal Aspect of the Cloud by Giuseppe Vaciago
Legal Aspect of the Cloud by Giuseppe VaciagoLegal Aspect of the Cloud by Giuseppe Vaciago
Legal Aspect of the Cloud by Giuseppe Vaciago
 

Dernier

The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxLoriGlavin3
 
How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity PlanDatabarracks
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxLoriGlavin3
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionDilum Bandara
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Mark Simos
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 3652toLead Limited
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays
 
Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxhariprasad279825
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsSergiu Bodiu
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 
Moving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfMoving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfLoriGlavin3
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett
 

Dernier (20)

The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptx
 
How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity Plan
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An Introduction
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko
 
Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptx
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platforms
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 
Moving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfMoving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdf
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024
 

Android malware overview, status and dilemmas

  • 1. Malicious Android Apps Overview, Status and Dilemmas
  • 2. 1,260 Samples Analyzed (2012) Manual analysis of samples by Yajin Zhou & Xuxian Jiang 36.7% leverage root-level exploits 90% turn devices into bots 45.3% dial/text premium numbers in background 51.1% harvest user information Other goods encrypted root-level exploit or obfuscated C&C address
  • 3. Attackers Goals Steal Sensitive Data intercept texts or calls steal passwords Turn Devices Into Bots perform malicious actions gain root privileges Direct Financial Gain call or text premium numbers steal online banking credentials
  • 4. ZitMo & SpitMo (2011) ● Companion of the famous ZeuS and SpyEye trojans. ● Steal the mTAN or SMS used for 2-factor authentication.
  • 5. The attack scheme (1) www.yourbank.com username: user password: ************ INFECTED COMPUTER er *** : us ******* me rna ord: ** use sw pas $$ $$ $ $$ $ $ $$ $$
  • 6. 2-factors authentication (password + secret code) ONE TIME SECRET CODE ************ GO!
  • 7. The attack scheme (2) www.yourbank.com username: user password: ************ ONE TIME SECRET CODE INFECTED COMPUTER TYPE IN THE ONE TIME SECRET CODE OK EXPIRED TYPE IN THE ONE TIME SECRET CODE
  • 8. The attack scheme (2) www.yourbank.com username: user password: ************ INFECTED COMPUTER inject QR code
  • 9. Luring Users with a QR Code USERNAME user PASSWORD ************ SCAN TO LOGIN Login
  • 10. The attack scheme (3) www.evil.org/fake-login-app.apk
  • 11. The attack scheme (4) www.yourbank.com username: user password: ************ ONE TIME SECRET CODE INFECTED COMPUTER INFECTED SMARTPHONE TYPE IN THE ONE TIME SECRET CODE OK
  • 12. The attack scheme (5) FINANCIAL TRANSACTIONS $$$$$$$ ALERT THE MALWARE HIDES SMSs FROM THE BANK
  • 13. Perkele (2013) ● Sold for $1,000 on underground markets/forums ● Development kit for bypassing 2-factor authentication
  • 14. Better than Perkele Hand of Thief kit (Android port, late 2013) $950
  • 17. M VE A H ST U Prediction vs. Actual Data Number of Android malware samples E! ID SL Q4 2012 120,000 Source (Symantec, October 2013)
  • 19.
  • 20.
  • 21. Malware Distribution Google Play Store. Alternative markets. Underground affiliate programs (growing business).
  • 22. Alternative Markets (91) Andapponline Aptoide Soc.io 92Apk T Store Cisco Market SlideMe Insydemarket Android Downloadz AppChina Yandex App Store Lenovo App Store AndroidPit PandaApp MerkaMarket CoolApk Pdassi Omnitel Apps AppsZoom AppsEgg Good Ereader Anzhi Market iMedicalApps TIM Store ApkSuite AppTown Mobile9 EOE Market Barnes & Noble T-Store Opera App Store AppBrain Phoload HiApk Nvidia TegraZone T-Market Brothersoft AppsLib Androidblip Nduoa AppCake AT&T Camangi ESDN 1Mobile Baidu App Store Handmark CNET Blackmart Alpha Mobilism Brophone D.cn Appolicious F-Droid Mob.org LG World Gfan Appitalism Android games room Amazon Handango Samsung App Store Millet App Store WhiteApp AndroLib Mikandi Handster Taobao AppCity GetJar Nexva market AppsFire Tencent App Gem AlternativeTo Tablified Market Yet Another Android Market Mobango Hyper Market Appzil AndroidTapp No Crappy Apps Naver NStore Fetch Moborobo 91mobiles mobiles24 Android Freeware MplayIt Hami Olleh Market wandoujia
  • 23. DroidDream (2011) - Host Apps Falling Down Super Guitar Solo Super History Eraser Photo Editor Super Ringtone Maker Super Sex Positions Chess Hilton Sex Sound Screaming Sexy Japanese Girls Falling Ball Dodge Scientific Calculator Dice Roller
  • 24. DroidDream (2011) - Info Stealing Steals C&C http://184.105.245.17:8080/GMServer/GMServlet IMEI IMSI exploid root-level exploit. device model SDK version Copy of the original public exploit! language country
  • 25. DroidDream (2011) - More Details Downloads 2nd payload. Encrypts C&C messages. Installs payload under /system No icon nor installed application is visible to the user. zHash uses the same exploit.
  • 26. DroidDreamLight (2011) ● Massive code refactoring. ● No root exploit. ● Steal same data. ● Receives remote updates. ● Affected 30–120k users. Image source (Trend Micro)
  • 27. What the Malware! Source (Symantec, October 2013)
  • 30.
  • 31. Plankton (2011) ● Update only some components. ● Silent update, no user participation. ● Payload hosted on Amazon. ● Inspired the AnserverBot family.
  • 32. Plankton (2011) Silent update (first family) Command & Control: Image source (Sophos)
  • 33. Countermeasures Google Play app vetting Install and permission confirmation SMS/call blacklisting and quota App verify (call home when apps are installed - incl. 3rd party) ● App sandboxing ● SELinux in enforcing mode (Android 4.4) ● AV apps ● ● ● ●
  • 34. Blacklist & SMS Limits CyanogenMod >=10.2 Blacklist numbers 50 SMS per 30 minute limit
  • 36. Apps Must Declare Permissions User1 User2 User3 App1 Malicious App App2 App3 Virtual machine Virtual machine Virtual machine Process1 Process2 Process3 ... ... PERMISSIONS Linux kernel
  • 38. Selective Permissions Introduced in 4.3. Users can selectively filter permissions. That's great!
  • 39. Google claimed its release was accidental Removed it in 4.4
  • 40. Perms: Malware Goodware vs. Source: Y. Zhou and X. Jiang, “Dissecting Android Malware: Characterization and Evolution,” in Proceedings of the 33rd IEEE Symposium on Security and Privacy, 2012, pp. 95–109.
  • 41. No primitives for process auditing User1 User2 User3 App1 Malicious App ... ANTIVIRUS APP Virtual machine Process1 ... PERMISSIONS Linux kernel Malicious App SD card
  • 42. Workarounds (back in the '80s) Signature-based matching (evaded by repackaging). Scan (limited) portion of the storage. Send sample to cloud service (malware can sniff network). Custom kernel (not market proof).
  • 43. TGLoader (2012) - Root 'n text No permissions. Root the phone. Loads 3 malicious APKs. Premium texting. C&C communication. Exploid root exploit
  • 44. Asroot (2011) Simple, standalone app. Uses asroot root exploit. Not really widespread.
  • 45. Malware Apps on Google Play 2010 (2) TapSnake, SMSReplicator 2011 (13) DroidDream, zHash, DroidDreamLight, Zsone, Plankton YZHC, SndApps, Zitmo, Asroot, Gone60, DroidKungFu (2)
  • 46. App Verify Source: A. Ludwig, E. Davis, and J. Larimer, “Android - Practical Security From the Ground Up,” in Virus Bulletin Conference, 2013.
  • 47. Countermeasures and Downsides Google Play app vetting Few apps made it through it Permission confirmation Unaware users SMS/call blacklisting and Must know the numbers quota Must know the malware App verify Root exploits + ask App sandboxing permissions
  • 48. Application Signing ● No PKI ○ Apps signed with self-signed certs ○ AppIntegrity proposes a lightweight, neat solution ● Signature not checked at runtime ○ Can add new code at runtime and break the signature ● MasterKey vulnerability (CVE-2013-4787,
  • 49. Exploited by Adr/MstrKey-A ● ...as well as Skullkey ● Signed-unsigned integer values vulnerability (Jul 2013)
  • 50. BaseBridge (2011) ● Asset file hides the payload. ● Register to lots of events. ● Gains root privileges via RATC exploit. ○ spawn RLIMIT_NPROC-1 processes ○ kill adbd ○ spawn 1 process to race against adbd setuid()-ing ● Steals data (e.g., IMEI) + premium texts.
  • 51. BaseBridge (2011) Source: Y. Zhou and X. Jiang, “Dissecting Android Malware: Characterization and Evolution,” in Proceedings of the 33rd IEEE Symposium
  • 52. Academic Measurements 2010–October 2011 [Zhou et al., 2012] 49 families 20–76% detection rate October 2011 [Vidas et al., 2013] 194 markets facilitate malware distribution 0–32% detection rate (I don't really buy
  • 53. Our Measurements 2–8% of the apps are known malware (Jun-Nov 2013)
  • 54. Our Measurements 10–20% of the apps are known adware (Jun-Nov 2013)
  • 55. CarrierIQ (2011) - Not Really Malware 140M devices including Sprint, HTC, Samsung. Controversial app used for enhancing "customer experience". Log keystrokes. Record calls. Store text messages. Track location.
  • 56. Fake CarrierIQ Detector :-) Detects CarrierIQ. It actually finds IQ if is there. Premium texter malware. http://www.symantec.com/connect/blogs/day-afteryear-mobile-malware
  • 57. Find if IQ services are installed. Tries to send premium SMSs (notice the nested try-catch).
  • 58. RootSmart (2012) ● 2nd malware w/ GingerBreak exploit (1st was GingerMaster) ● Asks lots of permissions (suspicious ones) ○ MOUNT_UNMOUNT_FILESYSTEMS ○ RECEIVE_BOOT_COMPLETED ○ CHANGE_WIFI_STATE ● Suspicious broadcast receiver ○ NEW_OUTGOING_CALL ● Fetches the exploit from obfuscated URL
  • 59. Friendly Marketplaces Top 5 authors publish both goodware and known malware.
  • 60. Moghava (2012) - Annoying No monetary gain. Protest intended. Yet, very annoying. http://www.symantec. com/connect/blogs/androidmoghava-recipe-mayhem
  • 61.
  • 62. LuckyCat (2012) - Used in APT 1st known used in APT. SMS initiated: "[...] time to renew data plan [...]" URL with WebKit exploit (this is drive-by!) Track user GPS, steal data. Naïvely encrypted C&C communication. http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_adding-android-and-mac-
  • 63. Chuli (2012) - Again, in APT High-profile Tibetan activist email hacked. Used to send malicious APK to other activists. Steals data (SMS, contacts, IMEI, GPS, etc). https://www.securelist.com/en/blog/208194186/Android_Trojan_Found_in_Targeted_Attack
  • 64. Registration Service Provided By: SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO., LTD. Domain Name: DLMDOCUMENTSEXCHANGE.COM Registration Date: 08-Mar-2013 Expiration Date: 08-Mar-2014 Status:LOCKED The domain registration data indicates the following owner: Registrant Contact Details: peng jia (bdoufwke123010@gmail.com) beijingshiahiidienquc.d beijingshi beijing,100000 CN Tel. +86.01078456689 Fax. +86.01078456689
  • 65.
  • 66. Obad (2013) - Sophisticated Raises the bar. Could propagate via Bluetooth and WiFi. First emulator-aware malware. Anti dynamic analysis (corrupted XML) Anti static analysis (packed instr. + anti decompiling + encrypted strings) Gains device administration rights to hides itself.
  • 67. Corrupted XML No attribute names. Accepted by smartphones. Makes sandboxes fail.
  • 68. Bogus Instructions Targets specifically the dedexer disassembler. Prevents automatic repackaging of dex for analysis. Needed manual intervention. http://joe4mobile.blogspot.com/2013/06/analyzing-obada-aka-most-sophisticated.html
  • 70. Device Admin Privs Used to administer devices. http://www.comodo. com/resources/Android_OBAD_Tech_Reportv3.pdf Fool the user. http://developer.android. com/guide/topics/admin/device-admin.html
  • 71. Baseline Features Steal data. Remote update. Execute shell commands. C&C communication (hardcoded...).
  • 72. Mouabad (2013) - Sneaky Dialer Works when device goes to lock mode. Stops working right away when the user unlocks the device. Calls premium numbers located in China. No sophisticated anti-analysis techniques.
  • 73. Stels (2013) - Spreads via Botnet Spreads through Cutwail botnet via spam emails. Vulnerable website to drop PHP script. PHP script fingerprints the client. Malicious (non-sophisticated) APK if browser == Android. Steals the usual data. http://www.secureworks.com/cyber-threat-intelligence/threats/stels-android-trojan-malware-analysis/
  • 74. How Many Infected Devices? Damballa & GaTech DNS traffic analysis (2012) Mobile devices (0.0009%) 3,492 of 380,537,128 Kindsight Security Lab Mobile devices 0.50% (Q1) 0.52% (Q2) Android devices 1.00% (Q2)
  • 75. Conclusions ● Many infected apps (hundreds of thousands) ● Low infection rate (0.0009–1.0%) ○ Wide range of uncertainty ○ The ROI per infected device must be high! ● Authors have just started to show what they can do.