• Home

  • Documents

  • App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other...
52
1 App Markets Android Security - SS 2016

App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

  • Upload
    others

  • View
    0

  • Download
    0

Embed Size (px)

Citation preview

Page 1: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

1

App Markets

Android Security - SS 2016

Page 2: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

SECURITY IMPACT OF MARKETS

§ Marketsstreamlinetheprocessoffindingandinstallingapplications

- Formaeasy-to-usecentralsoftwaredistributionchannelevenformostcasualusers

§ Assuch,marketscanbe

- Averypowerfulfirstlineofdefenseagainstmaliciousorvulnerableapplications

- …averypowerfulattackeragainsttheend-user

2Android Security - SS 2016

Page 3: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

MARKETS AS FIRST LINE OF DEFENSE

§ Marketoperatorshaveinterestina”healthyecosystem”

- Noharmfulapplicationsfortheuserarebeingdistributedviathemarket(spyware,fraudapps,ransomware,backdoors,spam,…)

• Infact,mostuserswouldexpectthisfromthemarket

• But:Commonnotionofsecurityandprivacyhard,verysubjective(functionalitydesiredbyoneuser,considerharmfulbyother)

3Android Security - SS 2016

Page 4: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

MALWARE DISTRIBUTION [9]

32

6058

21

40

GooglePlay*

eoeMarket

alcatelclub

gfan

mmoovv

*Hasremotekillcapability

[Zhouetal.,NDSS2012]

Android Security - SS 2016 4

Page 5: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

MALWARE DISTRIBUTION [6]

Android Security - SS 2016 5

Page 6: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

MALWARE PREVALENCE [68,6]

§ Scanned1.2millionappsfrom33markets(mostinChina)

§ 127,429malwarediscovered,atleast20likelyzero-dayapps

- 34,026ofthoseweremissedbyexistingscannersonVirusTotal(syndicates≈50differentAVproducts)

- 30,552fromPlay

§ MalwareGenomeProject:

6Android Security - SS 2016

Page 7: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

MALWARE PREVALENCE [69]

§ Google’sself-reporting:

- <1%ofdeviceswithharmfulappfor2015

- ≈0.5%ofalldevicesonaveragehadharmfulappinstalled

7

GhostPushcampaign

Android Security - SS 2016

Page 8: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

MARKETS AS FIRST LINE OF DEFENSE

§ Marketoperatorshaveinterestina”healthyecosystem”

- Noharmfulapplicationsfortheuserarebeingdistributedviathemarket(spyware,fraudapps,ransomware,backdoors,spam,…)

• Infact,mostuserswouldexpectthisfromthemarket

• But:Commonnotionofsecurityandprivacyhard,verysubjective(functionalitydesiredbyoneuser,considerharmfulbyother)

- Appdeveloperswanttheirintellectualpropertyandrevenuebeingprotected(apppiracy,siphoningadrevenues,...)

• Appdeveloperswilldemandthisfromthemarket

8Android Security - SS 2016

Page 9: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

REPACKAGING [9,10]

§ APKissimplyanarchivefileformat

- Unzip,modifycontent,re-zip

- Easytomakeanapplicationmalicious(trojan,virus,changeadIDs)

§ But:APKsaresigned.Whyisrepackagingpossible?

- Technicallyeasytoremove(“strip”)theoriginalsignatureandre-signthere-packagedAPKwithanewcertificate

- Certificateareself-signed(easy);andeverybodycanbeadeveloperontheAndroidmarketandbeabletosignappsforpublication(stilleasy)

§ Doesnotallowmaliciousupdates,butbreakstrust-on-first-install

§ Repackagingoneofthemajorattackvectorsonalternativemarkets

- Distributemalware

- Siphonadrevenuefromlegitimate/originaldevelopers

9Android Security - SS 2016

Page 10: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

IMPACT OF ANDROID APPLICATION PLAGIARISM [11]

§ InvestigationHTTPadvertisingtrafficgeneratedbymobileapplicationsatatier-1UScellularcarrierfor12daysin2012- Analysisof265,359freeapplicationsfrom17Androidmarketsaroundthe

world• Detect“clones”ofapps:5,431cloneclustersconsistingof44,268unique

applications

• Beabletoidentifyoriginalapps’andtheirclones’trafficinthecapturedtraces(admob ids,strings,etc)

10

Lost revenue calculated to be between 10–50%!

Android Security - SS 2016

Page 11: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

MARKETS AS FIRST LINE OF DEFENSE

§ Market’spossibilitiesonimprovingandmaintainingthehygieneoftheappecosystem

- Imposeandenforcepolicies,e.g.,dataaccessanddistribution,userconsentandtransparency(appvetting)

- Warnusersabout(potentially)harmfulapplicationsontheirdevicesandletusersdecidetokeepthoseappsornot

• forthreatsthatareundisputedlymalwaretakeautomaticmeasuresandinformusersafterfact

- Warndevelopersaboutvulnerable(external)codeandbadsecuritypracticesintheirsubmittedapps

• blockapppublicationunlessfixed

11Android Security - SS 2016

Page 12: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

GOOGLE’S SELF-DEFINED ROLE [69]

§ Forinstance,Google’sperspectiveonitsroleintheecosystem:

12Android Security - SS 2016

Page 13: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

MARKETS AS FIRST LINE OF DEFENSE

§ Attheheartofthosemeasures:

- Monitoringthecurrentstateoftheecosystematlarge,e.g.,marketservicesrunningontheend-userdevicesasdatacollectionpoints

13Android Security - SS 2016

Page 14: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

GOOGLE’S DATA COLLECTION [69]

“Throughaggregated,anonymizedsecuritydatasentfromuserdevices,wegatherinformationandmonitorthegeneralstateoftheAndroidecosystem.TheseservicesscanforPotentiallyHarmfulApplicationsatinstalltime,performregularscansofinstalledapplications,andprovideuserprotection.TheservicesalsoautomaticallysendanonymizeddatabacktoGoogle,whichweusetomonitortheoverallcleanlinessoftheAndroidecosystem.”

“Attheendof2015,Googleprovidedover400milliondevicesecurityscanseachday,contributingbillionsofpiecesofnewdatatoouranalysisengineeveryday.”

14Android Security - SS 2016

Page 15: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

MARKETS AS FIRST LINE OF DEFENSE

§ Attheheartofthosemeasures:

- Monitoringthecurrentstateoftheecosystematlarge,e.g.,marketservicesrunningontheend-userdevicesasdatacollectionpoints

- Analyzingsubmittedanddiscoveredapps• Staticanalysis:Extractapplicationfeaturesandcomparedtoexpectedgood/badbehavior,cananalyzeappsatlarge-scale

• Dynamicanalysis:Complementsstaticanalysis,discoverruntimebehavior(e.g.,networkconnections)andcanusestaticanalysisresultsasinput

• Heuristics,signatures,andsimilarityanalysis:Compareappsignature(e.g.,hashofcode)tolistofknownappsforidentification,compareapp’ssimilaritytootherknowngood/badbehavior(e.g.,usingmachinelearning)

• Externalinformation:E.g.,inputbypartnersandindependentresearchers,backgroundinformationontheappdeveloper

15Android Security - SS 2016

Page 16: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:DROIDMOSS [12]

§ Pair-wisesimilaritymeasurementbetweenappsusingfuzzyhashingbasedonapps’features

- Studyresult:Clonedappsmainlyusedtosiphonadrevenue;fewcaseswithbackdoors/malware

Android Security - SS 2016 16

Page 17: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:DNADROID [13]

§ Pair-wiseProgramDependenceGraphcomparisonforclonedetection

§ Shouldberobustagainst- Highlevelmodifications(e.g.,packagenamechanges,methodname

changes,etc.)- Methodrestructuring(e.g.,movemethodstootherclasses,splitmethods

intosmalleronesorcombinemethods,etc.)- Controlflowalternatives(e.g.,swappingif-else branches,changefor into

while loops,etc.)- Add/deletingthatisirrelevantforcomputedresults- Reorderingofcodesegments

Android Security - SS 2016 17

Page 18: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:PIGGYAPP [10]

§ Efficientlydetectrepackagedand“piggybacked”apps

Android Security - SS 2016 18

Detectprimaryandsecondary codemoduleswithintheProgramDependenceGraphObservations:• Piggybackedcodenotpartofprimarycode• Cloneshaveshared/similarprimarycode

Primarycode(accordingtoManifest)

Page 19: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:MASSVETT [68]

§ Difference/Commonprogramcode/viewcomponentscomparisonbetweensubjectandallother appstodetectrepackagedapps

- Efficientalgorithm(≈10sperapp),scanned1.2millionapps

• Mapsfeaturesofapp’sControlFlowGraphintoavalue(geometriccenter)whichcanbecomparedbetweenappsforsimilarity

Android Security - SS 2016 19

Establishrelationbetweenappsbased onViews:detectappswithsimilarviewstructures(priorresults:mostrepackagedappskeepviewstructure)

DiffCom analysistodetectmaliciouscode

Page 20: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:DROIDRANGER [9]

Android Security - SS 2016 20

§ Detectingmalicious(unknown)apps

Basedonsetof requestedpermissions(earlierworkrevealedthatpermission-setsofmalware

significantlydifferfrombenignapps)

Basedonsuspiciousbehavior(e.g.,fetchandexecutecode)

Page 21: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:DREBIN[70]

§ On-device analysisofapps:gathervariousfeaturesfromapp’scodeandmanifest,embedtheminajointvectorspace,suchthattypicalpatternsindicativeofmalwarecanbeidentifiedusingmachinelearningtechniques

Android Security - SS 2016 21

Features:Hardwarecomponents,requestedpermissions,appcomponents,intent-filters,APIcalls,usedpermissions,networkaddresses

SupportVectorMachines,producesefficientandexplainabledecisionmode;efficientherebecauseofthesparsevectorspace(545kdifferentfeatures)

Page 22: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:RISKRANKER [71]

§ Detectingmalwarewithoutrelyingonsamples/signaturesofmalware

- Detected322zero-daymalwaresamplesfrom11familiesintestset

Android Security - SS 2016 22

§ Riskanalysis:Categorizeappsintorisklevels

§ First-orderanalysis(scalability):Exposehighormediumriskapps- Detectattackcodeusing

exploitsignatures- ProtectedAPIslikepremium

SMScalledwithoutuserinteraction

§ Second-orderanalysis:Analyzeforsuspiciousbehavior(e.g.includedchildAPKs,decryptionroutinesforpayload)

Page 23: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:MAST[72]

§ MobileApplicationSecurityTriage:Directcostlyanalysistotheappswiththehighestpotentialtoexhibitmaliciousbehavior

- MultipleCorrespondenceAnalysis(=correlationbetweenmultiplecategoricaldata)onattributesextractedfromappstorankapps→Find95%ofmalwareatcostofanalyzing13%ofnon-maliciousapps

- Attributes:114permissions,92intent-filters,existenceofnativecode,presenceofzipfiles;trainedwith15kapps700malwaresamples

Android Security - SS 2016 23

Outlierindicatespotentialharmfulappforfurtheranalysis

Page 24: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:CHABADA[73]

§ Clusterappsbytheircategoryanddetectanomaliesw.r.t.toAPIusagetoflagpotentialmalware

- Flagged56%ofnovelmalwarew/oneedfortrainingmalwaresignatures/patterns

Android Security - SS 2016 24

TopicmodelingwithLatentDirichlet Allocation(LDA)todeterminetopicfromappdescription

One-classSVMbasedanomalyclassification,createsrankedlistofapplicationsforeachcluster

Outlierscanbepotentialmalware,spyware,etc.orsimplyuncommonlybehavingapps

Page 25: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:WHYPER [74]&AUTOCOG [75]

§ ExaminewhetherappdescriptionjustifiestheneedfortherequestedpermissionsusingNLPtechniques(“description-to-permissionfidelity”)

- Focusonprivacyinfringementsinrelativelybenignapplicationsandon“userunderstandablepermissions”

Android Security - SS 2016 25

Mobileappsarepredominantlythinclients,andactionsandresourcesprovidedbytheapplicationframeworkAPIdocumentscancovermostofthe

functionalityperformedbythesethinclients

Page 26: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:DESCRIBEME [76]

§ Automaticallygeneratesecurity-centricappdescriptionsfromprogramanalysisusingNaturalLanguageGeneration(NLG)

Android Security - SS 2016 26

Revealtriggeringconditionsofcriticaloperations,entrypointdiscoverytogivecontext(GUIelements),

dataflowanalysistoexploreAPIdependencies

Description:OnceaGUIcomponentisclicked,theappretrievesyourphonenumber,andencodesthedataintoformat“100/app_id=an1005/ani=%s/dest=%s/phone_number=%s/company=%s/”,andsendsdatatonetwork,dependingoniftheuserselectstheButton“Confirm”.

Page 27: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

COLLABORATIVE VERIFICATION OF INFORMATION FLOWS [77]

§ Marketoperatorandappdevelopers(here”vendor”)collaborate

- Vendorannotatessourcecodewithinfoflowtypequalifiers

- Marketanalyzes/verifiesannotatedappsourcecode,compilesit,anddistributesit

• Auditofinformationflowdonemorequicklyandwithhigherconfidence

Android Security - SS 2016 27

High-leveldescriptionofintendedinfoflowsfrom

userperspective(“location→network”)

Page 28: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

ANDROID-SPECIFIC CHALLENGES OF STATIC ANALYSIS (1)

§ Androidapps’lifecycle:Severalentrypointstoapps(components),callbacksfromtheapplicationframework,async.executingcomponents

- Problem:Traditionalexecutablesonlyonesingleentrypoint

- CHEX[78]:Detecting“componenthijacking”attacks(permissionleakage,unauthorizeddataaccess,intentspoofing)usingreachabilityanalysisonPDG;noveltechniquetodiscovercomponententrypointsand“appsplitting”tomodeltheasynchronousexecutionsofmultipleentrypoints(split=subsetoftheappcodethatisreach- ablefromaparticularentrypointmethod)

- FlowDroid [79]:statictaintanalysisforAndroidapplicationswithprecisemodelofAndroid’slifecycle(andContext,Flow,Field,Object-sensitive)

Android Security - SS 2016 28

Page 29: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

ANDROID-SPECIFIC CHALLENGES OF STATIC ANALYSIS (2)

§ Appcomponentscancommunicatewitheachother(ICC;Inter-ComponentCommunication)suchasIntents,callingServicesorContentProviders

- Problem:Analysissofaronlywithinsinglecomponents,butnotflowtrackingacrosscomponents

- Epicc [80]:ResolvesICCcallparameters,butdoesnotlinkcomponents

- Amandroid [81]:Points-toinformationforallobjectsinanappinaflowandcontext-sensitivewayacrosscomponentsthatcanbeleveragedinsecurityanalysis,linkssourceandtargetcomponent

- IccTA [82]:Inter-componentcommunicationTaintAnalysistoolfordetectionofICClinksandleaks,considersallcomponenttypes,genericenoughforanydata-flowanalysis

Android Security - SS 2016 29

Page 30: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

ANDROID-SPECIFIC CHALLENGES OF STATIC ANALYSIS (3)

§ Dataandcontrolflowscanoccursthroughtheapplicationframeworkservices/appsbetweenappcomponents(implicitflowtransitionfacilitatedbytheframework)

- Problem:Blindspotinthecurrentdataandcontrolflowanalysis

- Edgeminer [83]:automaticallygenerateAPIsummariesthatdescribeimplicitcontrolflowtransitionsthroughtheAndroidframework;canbeusedinsecurityanalysistodetectsuchimplicitflowsthroughtheframework

• ImprovedFlowDroid’s detectionratesignificantly

Android Security - SS 2016 30

Page 31: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

GENERAL CHALLENGES OF STATIC ANALYSIS

§ Staticanalysiscanbeverylarge-scaling,but…

- Overapproximation

• Analysisoftenassumesthatmorebehaviorsarepossiblethanactuallywouldbe

• Analysisisundecidableinallgeneralityduetohaltingproblem

- Challengedbyencrypted,interpreted,ordynamicallyloadedcode

§ Thus:Complementedoftenwithsmall-scalingdynamictesting

Android Security - SS 2016 31

Page 32: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

DYNAMIC ANALYSIS:TAINTDROID [84]

§ Taint-trackingsystemfortheAndroidmiddlewareandkernel

- VariabletrackingthroughouttheDalvik VM

- Extendstrackingbetweenapplications(BinderIPC)andstorage(extendedattributes)

32

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Dynamic Taint Analysis

• Dynamic taint analysis is a technique that tracks information dependencies from an origin

• Conceptual idea:

‣ Taint source

‣ Taint propagation

‣ Taint sink

• Limitations: performance and granularity is a trade-off5

c = taint_source()...a = b + c...network_send(a)

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

TaintDroid• TaintDroid is a system-wide integration of taint

tracking into the Android platform

‣ Variable tracking throughout Dalvik VM environment‣ Patches state after native method invocation‣ Extends tracking between applications and to storage

• TaintDroid is a firmware modification, not an app6

Network Interface

Native System Libraries

Virtual Machine

Virtual Machine

Application Code Application CodeMsg

Secondary Storage

Message-level tracking

Variable-leveltracking

Method-leveltracking

File-leveltracking

Android Security - SS 2016

Page 33: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

DYNAMIC ANALYSIS:TAINTDROID [84]

§ Taintsourcesandsinkscarefullyintegratedintotheexistingarchitecturalframework

§ Sources

- Low-bandwidthsensors:location,accelerometer

- High-bandwidthsensors:microphone,camera

- Informationdatabases:addressbook,SMSstorage

- Deviceidentifiers:IMEI,IMSI,phonenumber

§ Sinks

- Networksockets

§ Limitations:onlyexplicitdataflows,nativecode

33Android Security - SS 2016

Page 34: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

DYNAMIC ANALYSIS:VETDROID [85]

§ Reconstructsensitivebehaviorofappsfromapermissionuseperspective

§ ExtendsTaintDroid:

- TaintsreturneddatafromAPIcallsthatrequiredapermissionwiththatspecificpermission

• Benefit:Automaticallytrackanyprotecteddatainsteadofonlypre-definedonesasinTaintDroid

- Tracksusageofthisdataacrossapplicationtoprofiletheapp’spermissionusagebehavior

• E.g.,doesappleaktainteddatatonetworkorfile,doesappinterruptorderedbroadcasts(forinstanceSMSreceived),etc.

- Usesprofilestobetterunderstandtheworkingsofmalwareandtovetappsforundesiredbehavior

Android Security - SS 2016 34

Page 35: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

DYNAMIC ANALYSIS:DROIDSCOPE [86]

§ Virtualization-basedmalwareanalysisplatform

- InstrumentedAndroidemulator

- ReconstructbothOS-levelandJava-levelsemantics

• VMintrospection

Android Security - SS 2016 35

Page 36: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

PROBLEM OF DYNAMIC ANALYSIS:CODE COVERAGE

§ Codecoverageproblemwithautomatedtestingofapp:

- Asforstaticanalysis:Multipleentrypointsinapplicationlife-cycle:Receivers(aseventtriggersandcallbacksviaIntents),Services,ContentProviders,Listeners…

• Traditionalexecutableshaveasingleentrypoint

- Appsusuallystronglyuser-drivenandinteractionnecessaryforhighcodecoverage:InputtoActivities(buttons,credentials,permissiongranting,useraccounts,contactsentries,…)

36Android Security - SS 2016

§ TaintDroid:NoautomatedtestingofappsVetDroid:Rudimentary“applicationdriver”usingMonkeytool&eventinjection;leavesthischallengeopen

Page 37: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

DYNAMIC ANALYSIS:SMARTDROID [87]

§ Hybridapproach(staticanddynamicanalysis)torevealUI-basedtriggerconditionsinAndroidapps- Staticanalysis:

ExtractexpectedActivityswitchpathsbyanalyzingActivityandFunctionCallGraphs

- Dynamicanalysis:TraverseeachUIelementautomaticallyandexploretheUIinteractionpathsthatleadtowardssensitiveAPIcalls

§ Limitations:- NodatadependencyinACG

- Nologic-basedtriggers• “Pressbutton5timestotrigger”

- Obfuscationandreflection

Android Security - SS 2016 37

Modifiedemulator

Page 38: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

DYNAMIC ANALYSIS:APPSPLAYGROUND [88]

§ AppsPlayground:AutomateanalysisofAndroidapps

38Android Security - SS 2016

Triger codeineventreceivers(locationchange,etc.)

ExploretheGUIviafuzztesting,intelligentexecution torecognizeheuristicallywhichdatahastobeputintoGUIandguideexploration

Averagecodecoverage:33%fortestapps

Page 39: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

DYNAMIC ANALYSIS:COPPERDROID [89]

§ AutomaticVMI-basedanalysissystemtoreconstructthebehaviorofAndroidapps(malware)

- Monitorslow-levelinteractionsbetweenappandsystem(dex andnativecode,independentlyofobfuscation/reflection)

• Canreconstructcomplexintra- andinter-processcommunicationwhosesemanticsareusuallycontextualizedthroughcomplexobjects

• Recreateresources(e.g.,files,networkcommunication,etc.)byinferringdatadependenciesbetweensystemcalls(forwardslicinganddef-usechainsbetweencalls)

- Appsimulationtechniquetotriggerhighcoverageofcode

• Leveragestaticanalysisofanappasinputfortargetedsimulationstrategyusingsimpleinputs(sendingtargetedIntents,eventslikephonecallorlocationupdate,keyboardinput,…)

39Android Security - SS 2016

Page 40: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

DYNAMIC ANALYSIS:DROIDMATE [90]/BOXMATE [91]

§ AutomaticGUIexecutiongeneratorforapps:automaticallyinteractwithGUIelementsofanapptotriggerasmuchlogicaspossible

- Appisinstrumentedwithmonitoringcode

- Startingfromthemainactivityexploresappinafeedbackloop

- ExplorationstrategybasedondisplayedGUIelementsandmonitoredeventsafterlastaction

- Actioncanbeclick,long-click,presshome,pressback,reset,terminate

- Explorationuntilterminationcriterionismet

40Android Security - SS 2016

Page 41: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

DYNAMIC ANALYSIS:BRAHMASTRA [92]

§ Testing3rd partycomponentsofapps

- StaticcallgraphanalysistoconstructchainofActivitiesandinteractionstoreach3rd partycomponents

- Rewritingtheappto“jumpstart”3rd partycomponents

• Appautomaticallymakesseriesofcallstoopenthe3rd partycomponentasfastaspossible(e.g.,pruneprefixActivities)

- Runtimeanalyzertocollectinformationaboutthe3rd partycomponents

§ Analysisof3rd partycodein2.7xmoreappsanddecreasetestdurationbyfactor7

Android Security - SS 2016 41

Page 42: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

DYNAMIC ANALYSIS:APPAUDIT [93]

§ Goal:Usingsynergyofstaticanalysisanddynamicanalysistospeedupanalysisandreduceeffectsofoverapproximation ofstaticanalysis

§ Approach:Dynamicanalysisthatcansimulatetheexecutionofpart oftheprogramandperformcustomizedchecksateachprogramstate

- Evaluation:Comparativereportsofleaks,nofalsepositive,8.3xfaster,90%lessmemoryconsumption

Android Security - SS 2016 42

LargelyinspiredbytechniquesusedinJITcompilersandimprovementstosymbolicexecution

Page 43: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

PROBLEM:LOGIC BOMBS

§ Logicandtimebombscanmakeitveryhardtodetectmaliciousbehavioranddistinguishbenignappsfrommalware

Android Security - SS 2016 43

if(Build.FINGERPRINT.startsWith("generic"))return; //we are running in an emulator

String messageText = simCountryIso().equals("US") ? US : INTERN;String clazz = decrypt("fri$ds\&S"); 5 String method = decrypt("dvdf4$DCS");Class.forName(clazz).getMethod(method).invoke("+01234",null,messageText,null,null);

Date now = new Date();Date target = new Date(22,12,2016);

if (now.after(target)) {// do evil

} else {// do unsuspicious

}

Page 44: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

STATIC ANALYSIS:APPCONTEXT,HARVESTER,TRIGGERSCOPE

§ AppContext [94]:Identifyandextractthecontextsandeventsthattriggersecuritysensitivebehaviors

- Maliciousnessofsecurity-sensitivebehaviormorecloselyrelatedtotheintentionofthebehavior(reflectedviacontext)thantothetypeofresourceaccessed

§ Harvester[95]:Extractruntimevaluesevenfromobfuscatedcodethatusesreflection,hidessensitivevaluesinnativecode,loadscodedynamicallyorusesanti-analysistechniques

- forcedexecution:explicitlytriggersalldifferentbehaviors

§ TriggerScope [96]:Focusondetectingthetriggerchecksinsteadofbehavior

Android Security - SS 2016 44

Page 45: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

GOOGLE’S SELF-REPORTED MARKET SECURITY [69]

§ VerifyAppscloud-basedservicetocheckeveryapppriortoinstallationifpotentiallyharmful

- Warnuserorremoveautomaticallywithoutuserconfirmation

Android Security - SS 2016 45

Page 46: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

APP VERIFICATION [69]

DatacollectioninVerifyApps(Rareappcollection):

“VerifyAppsprotectsusersagainstapplicationsthatareinstalledfromanysource—whethertheycomefromGooglePlayoroutsideofPlay—soitisimportantthatoursystemshavevisibilityintoasmanyapplicationsaspossible.AllapplicationsthataresubmittedtoGooglePlayundergoareview.Similarly,allapplicationsthatGoogle’scloud-basedsystemsareabletolocateonpublicwebsitesarereviewed.

Startingin2015,userscansendapplicationsfromtheirdevicetoGoogleforreview.”

Technical:Extractingfeaturesandthencheckforsimilaritieswithexistingharmfulapps

46Android Security - SS 2016

Page 47: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

GOOGLE’S SELF-REPORTED MARKET SECURITY [69]

§ SafetyNet attestAPItohelpdeveloperscheckdeviceintegrity- Devicescontributesecurity-relatedinformationcloud-basedservices,

includinginformationaboutsecurityevents,logs,configurationinformation,andothersecurity-relevantinformation

- Whenavulnerabilityisfixed,codeisinsertedintotheplatform(orapp)whichgeneratesalogwhenapotentialexploitattemptisdetected.Thislogcontainsinformationrequiredtotrackexploitationtrendsandbetterunderstandtheeffectivenessofoursecurityimprovements.

- SafetyNet usedactivenetworkprobestoidentifycaseswherethesystemcertificatestorehasbeenmanipulated.

- AnomalyCorrelationEngine monitorsforchangesinkeydevicesecurityindicators andexamineswhichappschangedsincelastsecurestate;monitoringacrossmanydevicesallowspinpointingrelevantapps

- On-deviceclienthashessystempartitionandcomparesagainstacloud-basedservice withacollectionofknownsystempartitions

Android Security - SS 2016 47

Page 48: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

GOOGLE’S SELF-REPORTED MARKET SECURITY [69]

§ Machinelearningtoseepatternsandconnectionshumanswouldmiss,continuousmonitoringandrefinementtoimproveprecision- Endof2015:ongoingautomatedanalysisofover35millionAPKs

(everyversioneverpublishedonPlayaswellasallcollectedones)- TensofthousandofCPUcoresandterabytesofRAM,petabytesof

storage§ Inputs:Staticanalysis,dynamicanalysis,3rd partyreports,developer

relationships,signatures,SafetyNet,heuristicsandsimilarityanalysis,humananalysts- SA:findinglinkedfunctionalityacrosscomponents,detectingSSL

misconfigurations- DA:simulatelargenumberofdifferentdevicesanddetectanomalies,use

SAresultstoincreaseDAcodecoverage- Honeypotswithfakeaccountdata- Decomposeappsintofeaturesandanalyzefeaturesimilaritytosee

relationsbetweenappsusingadv.machinelearning- Over90%oftimesauserinstallsappnotfromPlay,theappisknownand

canbecheckedagainstsignature- MonitoringC&Ccommunicationtodetectmalwareinstallcommands

Android Security - SS 2016 48

Page 49: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

GOOGLE’S SELF-REPORTED MARKET SECURITY [69]

§ AppSecurityImprovementProgramidentifiesappsinGooglePlaythathaveknownsecurityvulnerabilities(throughincorrectcodingpracticesorbyusingknownvulnerablelibraries),notifiesthedevelopersoftheirapp’svulnerabilities,andencouragesthemtoxthevulnerabilities

- DevelopersarealertedviaemailandthePlayDeveloperConsole

- 2015:100kappsimproved

• coveringknownvulnerabilitiesinthefollowinglibraries:Vungle,ApacheCordova,WebView SSL,GnuTLS,andVitamio

Android Security - SS 2016 49

Page 50: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

ENCRYPTED APKS AND FORWARD LOCKING

§ SinceAndroid4.1supportfordeliveringencryptedAPKs

§ Forwardlocking(orcopyprotection)

- Goal:preventpaidcontentfrombeing(easily)stolenfromdevices

- Since4.1:Encryptedappcontainers(AndroidSecureExternalCaches(ASEC))togetherwithfilesystemaccesscontroltostoreappcontentsmoreprotected

§ Result:APKsaretransferredandstoredinencryptedform

- UsedbyPlayandavailabletocustomappinstallers

- However:Ifdevicebeingrooted,protectedcontentorencryptionkeyscouldbeextracted(butstillbetterthanw/oencryption)

Android Security - SS 2016 50

Page 51: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

PROBLEM:MULTI-MARKET ECOSYSTEM [97]

§ Problem:Multi-marketslimit/eliminatesecuritycharacteristicsofsinglemarketmodels

- Kill-switches(whichmarketauthorizedtokillwhichapps?)

- Developernameconsistency

§ Approach:Appinstaller(Meteor)withextensiblesetofconfigurablesecurityinformationsourcesandkill-switchauthorities

51Android Security - SS 2016

Additionalappinfos:virusreports,privacyviolations,expertratings,otherappsbysamedeveloper(appdatabases)

Crucial:connect packagesignaturestodeveloper/application(developerregistries)

UniversalappID={Hash(packagename,dev.cert),Hash(binary)}

Page 52: App Markets - Universität des Saarlandes · - Method restructuring (e.g., move methods to other classes, split methods into smaller ones or combine methods, etc.) - Control flow

MARKET AS THE ATTACKER [98]

§ Marketsattractivetargetstobecoerced/pressuredintodistributingmalicioussoftware(updates)toorwithholdingapps/updatesfromtargetedusers

§ EasywithAndroid’scurrentappsigningmodelandmarket’sintransparency (blindtrustbyusers)

52Android Security - SS 2016

§ ApplicationTransparency(AT):threedifferentkindsofcryptographicproofsthatallowsuserstoverifytheauthenticityofappsprovidedbyappmarkets(usinglogserversandauditors)- ProofofPresence:Informationaboutpresence

ofanappinmarket- ProofofCurrency:Informationabout

currentness ofanapp’sversion- ProofofAbsence:Verifythatappindeeddoes

notexistonmarket


Business Restructuring Plan Restructuring of Shareholding ...cgs.listedcompany.com/misc/shareholderMTG/EGM2014/20140115-CG… · Business Restructuring Plan Restructuring of Shareholding

Business Restructuring Plan Restructuring of Shareholding ...cgs.listedcompany.com/misc/shareholderMTG/EGM2014/20140115-CG… · Business Restructuring Plan Restructuring of Shareholding

Documents
Best Methods of Railway Restructuring and Privatizationregulationbodyofknowledge.org/wp-content/uploads/2013/03/Kopicki... · BEST METHODS OF RAILWAY RESTRUCTURING AND PRIVATIZATION

Best Methods of Railway Restructuring and Privatizationregulationbodyofknowledge.org/wp-content/uploads/2013/03/Kopicki... · BEST METHODS OF RAILWAY RESTRUCTURING AND PRIVATIZATION

Documents
Montague Grammar - Universität des Saarlandes

Montague Grammar - Universität des Saarlandes

Documents
Universität des Saarlandes | Universität des Saarlandes ......Universität des Saarlandes Saarbrücken, April 7, 2017 Wahlvorstand für die Personalratswahl des wissenschaftlichen

Universität des Saarlandes | Universität des Saarlandes ......Universität des Saarlandes Saarbrücken, April 7, 2017 Wahlvorstand für die Personalratswahl des wissenschaftlichen

Documents
Automated Formal Methods for Embedded Systems€¦ · Automated Formal Methods for Embedded Systems Bernd Finkbeiner Universitat des Saarlandes¨ Reactive Systems Group 2011/02/03

Automated Formal Methods for Embedded Systems€¦ · Automated Formal Methods for Embedded Systems Bernd Finkbeiner Universitat des Saarlandes¨ Reactive Systems Group 2011/02/03

Documents
Restructuring Status: Submitted to SECPO Restructuring

Restructuring Status: Submitted to SECPO Restructuring

Documents
Universität des Saarlandes | Universität des Saarlandes › fileadmin › upload › verwaltung › fundst… · Wiederholung von Teilprüfungen und/oder der Master-Arbeit Zeugnis

Universität des Saarlandes | Universität des Saarlandes › fileadmin › upload › verwaltung › fundst… · Wiederholung von Teilprüfungen und/oder der Master-Arbeit Zeugnis

Documents
UNIVERSIT AT DES SAARLANDES FA CHBEREICH INF ORMA TIK

UNIVERSIT AT DES SAARLANDES FA CHBEREICH INF ORMA TIK

Documents
Best Methods of Railway Restructuring and Privatization

Best Methods of Railway Restructuring and Privatization

Documents
Download - Universit¤t des Saarlandes

Download - Universit¤t des Saarlandes

Documents
Corporate Financial Restructuring - NYUigiddy/restructuring/restructuring.pdf · Corporate Financial Restructuring zCorporate restructuring ... What is the fundamental problem to

Corporate Financial Restructuring - NYUigiddy/restructuring/restructuring.pdf · Corporate Financial Restructuring zCorporate restructuring ... What is the fundamental problem to

Documents
Best Methods of Railway Restructuring and Privatization...BEST METHODS OF RAILWAY RESTRUCTURING AND PRIVATIZATION v 5. Description of the Network 104 6. Employment, Unionization, and

Best Methods of Railway Restructuring and Privatization...BEST METHODS OF RAILWAY RESTRUCTURING AND PRIVATIZATION v 5. Description of the Network 104 6. Employment, Unionization, and

Documents
Der große Crash - Universität des Saarlandes

Der große Crash - Universität des Saarlandes

Documents
Universität des Saarlandes | Universität des Saarlandes ......form a simple harmonic oscillator, a pump laser of frequency ω L will be modulated by the mechanical frequency and

Universität des Saarlandes | Universität des Saarlandes ......form a simple harmonic oscillator, a pump laser of frequency ω L will be modulated by the mechanical frequency and

Documents
V10: Cancerogenesis (II) - Universität des Saarlandes

V10: Cancerogenesis (II) - Universität des Saarlandes

Documents
Decomposing disjunction - Universität des Saarlandes

Decomposing disjunction - Universität des Saarlandes

Documents
Dissertation - Universität des Saarlandes

Dissertation - Universität des Saarlandes

Documents
CORPORATE RESTRUCTURING,CORPORATE RESTRUCTURING ... Book of PP-CRVI... · (iii) PROFESSIONAL PROGRAMME CORPORATE RESTRUCTURING, VALUATION AND INSOLVENCY Corporate Restructuring is

CORPORATE RESTRUCTURING,CORPORATE RESTRUCTURING ... Book of PP-CRVI... · (iii) PROFESSIONAL PROGRAMME CORPORATE RESTRUCTURING, VALUATION AND INSOLVENCY Corporate Restructuring is

Documents
FR Organische Chemie, Universität des Saarlandes, 66123 ...FR Organische Chemie, Universität des Saarlandes, 66123 Saarbrücken, Germany 0003184786.INDD 3 10/24/2017 7:29:10 PM COPYRIGHTED

FR Organische Chemie, Universität des Saarlandes, 66123 ...FR Organische Chemie, Universität des Saarlandes, 66123 Saarbrücken, Germany 0003184786.INDD 3 10/24/2017 7:29:10 PM COPYRIGHTED

Documents
1320inverted - Universität des Saarlandes

1320inverted - Universität des Saarlandes

Documents
Aljoscha Burchardt, Alexander Koller, Stephan Walter, Universität des Saarlandes,

Aljoscha Burchardt, Alexander Koller, Stephan Walter, Universität des Saarlandes,

Documents
Current Trends - Universität des Saarlandes · 12th lecture Modern Methods in Drug Discovery WS15/16 2 Cycle of optimization in the drug discovery pipeline Source: D.K. Agrafiotis

Current Trends - Universität des Saarlandes · 12th lecture Modern Methods in Drug Discovery WS15/16 2 Cycle of optimization in the drug discovery pipeline Source: D.K. Agrafiotis

Documents
Mining Sandboxes - Universität des Saarlandes

Mining Sandboxes - Universität des Saarlandes

Documents
Coordination - Universität des Saarlandes

Coordination - Universität des Saarlandes

Documents
Universit at des Saarlandes - publikationen.sulb.uni

Universit at des Saarlandes - publikationen.sulb.uni

Documents
9 May 2014, Frankfurt/Main EUROPEAN RESTRUCTURING DAY 2014noerr.com/Mailings/Restructuring/Noerr_European Restructuring Day... · EUROPEAN RESTRUCTURING DAY 2014 ... freeze, tools,

9 May 2014, Frankfurt/Main EUROPEAN RESTRUCTURING DAY 2014noerr.com/Mailings/Restructuring/Noerr_European Restructuring Day... · EUROPEAN RESTRUCTURING DAY 2014 ... freeze, tools,

Documents
Event Structures - Universität des Saarlandes

Event Structures - Universität des Saarlandes

Documents
Universitat des Saarlandes¨ · Edited by FR – Mathematik Universitat des Saarlandes¨ Postfach 15 11 50 66041 Saarbrucken¨ Germany Fax: + 49 681 302 4443 e-Mail: preprint@math.uni-sb.de

Universitat des Saarlandes¨ · Edited by FR – Mathematik Universitat des Saarlandes¨ Postfach 15 11 50 66041 Saarbrucken¨ Germany Fax: + 49 681 302 4443 e-Mail: [email protected]

Documents
Universität des Saarlandes: Innovative Studieneingangsphase

Universität des Saarlandes: Innovative Studieneingangsphase

Science
INSECT 2014 - Universität des Saarlandes

INSECT 2014 - Universität des Saarlandes

Documents