Scribd Logo
Upload

Welcome to Scribd!

  • 48 views

    Android Malware: Mario Ballano

    Uploaded by

    I-Keym AllSabotage Wilson
    This document discusses Android malware and security. It begins with an introduction to Android, including its security model. It then discusses the Android threat landscape, including the top mobile threats such as premium SMS billing, spyware, and adware. Statistics on Android malware volumes and the rise of polymorphism are presented. The document demonstrates how to infect an Android app package (APK) behind the scenes. It profiles the Android.Geinimi malware, one of the first with botnet capabilities, and concludes with a question and answer section.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    Android Malware: Mario Ballano

    Uploaded by

    I-Keym AllSabotage Wilson
    48 views31 pages
    This document discusses Android malware and security. It begins with an introduction to Android, including its security model. It then discusses the Android threat landscape, including the top mobile threats such as premium SMS billing, spyware, and adware. Statistics on Android malware volumes and the rise of polymorphism are presented. The document demonstrates how to infect an Android app package (APK) behind the scenes. It profiles the Android.Geinimi malware, one of the first with botnet capabilities, and concludes with a question and answer section.

    Original Description:

    d

    Original Title

    Symantec Itu Mobilge

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses Android malware and security. It begins with an introduction to Android, including its security model. It then discusses the Android threat landscape, including the top mobile threats such as premium SMS billing, spyware, and adware. Statistics on Android malware volumes and the rise of polymorphism are presented. The document demonstrates how to infect an Android app package (APK) behind the scenes. It profiles the Android.Geinimi malware, one of the first with botnet capabilities, and concludes with a question and answer section.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    48 views31 pages

    Android Malware: Mario Ballano

    Uploaded by

    I-Keym AllSabotage Wilson
    This document discusses Android malware and security. It begins with an introduction to Android, including its security model. It then discusses the Android threat landscape, including the top mobile threats such as premium SMS billing, spyware, and adware. Statistics on Android malware volumes and the rise of polymorphism are presented. The document demonstrates how to infect an Android app package (APK) behind the scenes. It profiles the Android.Geinimi malware, one of the first with botnet capabilities, and concludes with a question and answer section.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 31

    Android malware

    ITU Regional forum on Cybersecurity

    Mario Ballano
    Symantec
    1

    Agenda
    1 2

    Introduction to Android Androids Security Model

    3
    4 5

    Android Threat Landscape


    Behind the scenes: Android App-Infection Demo: Android.Geinimi

    Q&A

    Introduction to Android

    What is it?, Whos made it?

    Linux based Operating System for mobile devices

    Developed by the Open Handset Alliance (OHA)


    Consortium of 84 firms that develop standards for mobile devices, among its members are: Mobile Operators Handset Manufacturers Semiconductor Companies Software Companies Commercialization Companies Led by Google with other 34 members

    Android OS features

    Multiple handset layouts: VGA, 3D, traditional smartphone layouts.. Connectivity: GSM, CDMA, Bluetooth, Wi-Fi, WiMAX, UMTS, etc Messaging: MMS/SMS, Android Clout to Device (CD2M), Google Cloud Messaging (GCM) Web Browser (WebKit + V8) - 100% ACID on Android 4.0 Java support (Dalvik) Additional hardware support (GPS, accelerometers, gyroscopes, ) External storage (FAT32/Ext3/Ext4) Multi-tasking, multi-touch, video-calling, tethering, wide range of media supported formats, streaming support, etc
    5

    How spread is Android?

    Over 330 million devices worldwide 934.000 daily activations in Q1 2012


    Android 2.3 (Gingerbread) being the most widespread as of June 2012 with 65% of the devices.

    * Data above provided by Wikipedia

    How are third-party apps built?, where do they run?: The Dalvik VM
    Based on the Java VM

    Register-based
    Optimized for low memory requirements Applications are developed in Java and compiled into Java bytecode, a tool called dx translates them into Dalvik bytecode It is not a security boundary! Applications are allowed to run native code

    How are applications distributed?

    Applications are self-contained within Android application package files (APKs) Google Play is the main distribution hub of Android Apps, as of September 2012:
    ~675.000 applications available 25 billion app downloads

    There are plenty of other alternative Android markets Online file-share services
    9

    Androids Security Model

    10

    Android Permision scheme


    Apps that require additional capabilities must statically request them

    Android permissions:
    android.permission.*

    android.permission.RECEIVE_SMS
    android.permission.INTERNET

    Apps may also share resources by declaring permissions enforced by their signature level Permissions are granted to the App by the user at install time

    11

    Application Isolation
    Apps run in a sandboxed environment. The application sandbox does not rely on the Virtual Machine technology they run in, it is instead based on: Processes

    File permissions IPC mechanisms


    Isolates both native code and the Dalvik VM(s)

    12

    Application Signing
    Apps are signed with self-generated certificates No Certificate Authorities are involved

    Apps signed with the same certificate may share UID or get specific permissions granted

    13

    Android Threat Landscape

    14

    Top mobile threats

    15

    Whats of interest to malware creators in Android devices?

    Premium Rate Number Billing Spyware


    Search Engine Poisoning Pay-Per-Click

    Pay-Per-Install
    Adware mTAN stealing

    16

    Breakdown of mobile malware capabilities (2011)

    17

    Volume statistics
    Symbian signing Ikee worm on rooted phones 101 Families 16,000 Samples

    120 100 80 60

    40
    20

    0 2004

    2005

    2006

    2007

    2008

    2009

    2010

    2011

    2012

    Symbian

    IOS

    Android

    Android Malware statistics


    18000 16000 14000 12000 10000 8000 6000 4000 2000 0

    June 2012 > 16,000 malicious APKs identified

    Families

    Variants

    Samples

    The rise of polymorphism


    Exponential growth of malicious APKs (families: samples)

    1:8

    The rise of polymorphism


    Exponential growth of malicious APKs (families: samples)

    1:27

    The rise of polymorphism


    Exponential growth of malicious APKs (families: samples)

    1:159

    Android.Opfake (2012)
    Driving mobile polymorphism
    Sends Premium SMSs

    Unique (bad) APK every time

    Fake app markets


    Heavy use of social engineering

    Behind the scenes: Android App-Infection

    24

    Anatomy of an Android Application package file (APK)


    Based on Javas JAR file format Self-signed, signatures can be found within the META-INF directory Android Manifest, essential information about the application, including:
    Java package name, components(activities, services..), required permissions, etc

    Classes.dex, classes compiled in DEX format (Dalvik VM) May contain native code, usually within the lib\{platform} directories. Resources within res directory
    25

    Infecting an APK for dummies, step by step guide

    1. Unpack the given APK

    2. Inject malicious code


    3. Bump permissions up (if needed) 4. Repack the new APK

    5. Sign APK with self-gen certificate

    26

    Threat propagation

    Security Response Overview

    27

    Demo: Android.Geinimi

    28

    Android.Genimi profile
    Discovered on December 2010 One of the first known malwares with botnet capabilities for Android Uses a XML-based protocol + DES encryption Obfuscated code : ProGuard + encrypted strings (DES) Three wake-up entry points:
    Execution of infected App BOOT_COMPLETED broadcast SMS_RECEIVED broadcast

    Implements 36 different server-side commands divided in two categories, some of them overlap Believed to be a proof of concept malware prototype

    29

    Q&A

    Thank you!
    Mario Ballano Symantec
    31

    You might also like