67
Mobile Malware John Mitchell CS 155 Spring 2015

Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Embed Size (px)

Citation preview

Page 1: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Mobile Malware

John Mitchell

CS 155 Spring 2015

Page 2: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Outline

• Mobile malware– Common cases involve command and control,

information theft• Identifying malware

– Detect at app store rather than on platform• Classification study of mobile web apps

– Entire Google Play market as of 2014– 85% of approx 1 million apps use web interface

Page 3: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Mobile Malware

Page 4: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Some Trends

Page 5: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

iPhone: Operation Pawn Storm

• Trend Micro:– “an active economic and political cyber-espionage operation that

targets … military, governments, defense industries, and the media.”– Infects individuals to get to organizations

• Xagent– iOS 7: app icon is hidden, runs in background, restarts if terminated– iOS 8: app icon is visible; doesn’t automatically restart

• Apparently, iOS device needs to be jailbroken– Exact install process unknown– May require social engineering.

blog.trendmicro.com/.../pawn-storm-update-ios-espionage-app-found/

Page 6: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

XAgent app

• Collects user information– Collect text messages– Access contact lists, pictures, geo-location data– Start voice recording, read WiFi status– Get a list of installed apps, list of processes

• Command and Control (C&C) Communication– HTTP POST request to send messages– GET request to receive commands

Page 7: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Android malware example

Page 8: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Install malicious “conference app”

Page 9: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Malware behavior triggered by C&C server (Chuli)

Page 10: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Outline

• Mobile malware– Common cases involve command and control,

information theft• Identifying malware

– Detect at app store rather than on platform• Classification study of mobile web apps

– Entire Google Play market as of 2014– 85% of approx 1 million apps use web interface

Page 11: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

STAMP Admission System

Static

Dynamic

STAMP

Static AnalysisMore behaviors,

fewer details

Dynamic AnalysisFewer behaviors,

more details

Alex Aiken,John Mitchell,Saswat Anand,Jason FranklinOsbert Bastani,Lazaro Clapp,Patrick Mutchler,Manolis Papadakis

Page 12: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Abstract program execution

• States: mapping of variable names to values• Transitions: relation on pairs of states• Traces: sequence of states or state, transition pairs

Page 13: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Analysis

Convert bytecode to intermediate format (called Quads)

Step 1

Compute call graph using Class Hierarchy Analysis

Step 2

Build an edge-labeled graph G by processing Quads of each class

Step 3

Add new edges to G as per a set of rules until no rules apply

Step 4

Page 14: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Data Flow Analysis

getLoc() sendSMS()

sendInet()

Source: Location

Sink: SMS

Sink: Internet

Location SMS Location Internet

• Source-to-sink flows o Sources: Location, Calendar, Contacts, Device ID etc.

o Sinks: Internet, SMS, Disk, etc.

Page 15: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Data Flow Analysis in Action

• Vulnerability Discovery

Privacy PolicyThis app collects your:ContactsPhone NumberAddress

FB API Send Internet

Source: FB_Data Sink: Internet

WebSource:

Untrusted_Data SQL Stmt Sink: SQL

• Malware/Greyware Analysiso Data flow summaries enable enterprise-specific policies

• API Misuse and Data Theft Detection

• Automatic Generation of App Privacy Policieso Avoid liability, protect consumer privacy

Page 16: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Challenges

• Android is 3.4M+ lines of complex codeo Uses reflection, callbacks, native code

• Scalability: Whole system analysis impractical

• Soundness: Avoid missing flows

• Precision: Minimize false positives

Page 17: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

STAMP Approach

• Model Android/Javao Sources and sinks

o Data structures

o Callbacks

o 500+ models

• Whole-program analysiso Context sensitive

STA

MP

Android

Models

App App

Too expensive!

OS

HW

Page 18: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Data We Track (Sources)

• Account data

• Audio

• Calendar

• Call log

• Camera

• Contacts

• Device Id

• Location

• Photos (Geotags)

• SD card data

• SMS

30+ types of sensitive data

Page 19: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Data Destinations (Sinks)

• Internet (socket)

• SMS

• Email

• System Logs

• Webview/Browser

• File System

• Broadcast Message

10+ types of exit points

Page 20: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Currently Detectable Flow Types

Unique Flow Types = Sources x Sink

396 Flow Types

Page 21: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Example Analysis

Contact Sync for Facebook (unofficial)

Description:

This application allows you to synchronize your Facebook contacts on Android.

IMPORTANT:* "Facebook does not allow [sic] to export phone

numbers or emails. Only names, pictures and statuses are synced."

* "Facebook users have the option to block one or all apps. If they opt for that, they will be EXCLUDED from your friends list."

Privacy Policy: (page not found)

Page 22: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Chuli source-to-sink flows

Page 23: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Possible Flows from Permissions

Sources Sinks

INTERNETREAD_CONTACTS

WRITE_SETTINGSREAD_SYNC_SETTINGS

WRITE_CONTACTSREAD_SYNC_STATS

GET_ACCOUNTS WRITE_SECURE_SETTINGS

WRITE_SETTINGSINTERNET

Page 24: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Expected Flows

Sources Sinks

INTERNETREAD_CONTACTS

WRITE_SETTINGSREAD_SYNC_SETTINGS

WRITE_CONTACTSREAD_SYNC_STATS

GET_ACCOUNTS WRITE_SECURE_SETTINGS

WRITE_SETTINGSINTERNET

Page 25: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Observed Flows

FB APIWrite

Contacts

Send Internet

Source: FB_Data

Sink: Contact_Book

Sink: InternetRead

ContactsSource: Contacts

Page 26: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Outline

• Mobile malware– Common cases involve command and control,

information theft• Identifying malware

– Detect at app store rather than on platform• Classification study of mobile web apps

– Entire Google Play market as of 2014– 85% of approx 1 million apps use web interface– 28% have at least one vulnerability

Page 27: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

A Large-Scale Study of Mobile Web App Security

Patrick Mutchler, Adam Doupe,

John Mitchell, Chris Kruegel, Giovanni Vigna

Page 28: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Mobile Apps

Page 29: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Mobile Apps

Page 30: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Mobile Apps

Page 31: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

• Mobile web app: embeds a fully functional web browser as a UI element

Mobile Web Apps

Page 32: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Obj foo = new Object();addJavascriptInterface(foo,

‘f’);

JavaScript Bridge

JavaJavaScript

Page 33: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

JavaScript Bridge

JavaJavaScript

f.bar();

Page 34: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Why?

• Full-featured mobile web apps

• Expose phone functionality to JavaScript

Page 35: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Security Concerns

• Who can access the bridge?

– Everyone

Page 36: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Complete Isolation

Page 37: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Java

JavaScript

f.bar();

Page 38: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

JavaJavaScript

f.bar();

Page 39: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Static Analysis

• How many mobile web apps?

• How many use JavaScript Bridge?

• How many vulnerable?

Page 40: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Experimental Results

• 737,828 free apps from Google Play (Oct ’13)

• 563,109 apps embed a browser

• 219,404 use the JavaScript Bridge

• 107,974 have at least one security violation

Page 41: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Most significant vulnerabilities

1. Loading untrusted web content

2. Leaking URLs to foreign apps

3. Exposing state changing navigation to foreign apps

Page 42: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

1. Loading untrusted web content

2. Leaking URLs to foreign apps

3. Exposing state changing navigation to foreign apps

Page 43: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

“You should restrict the web-pages that can load inside your WebView with a whitelist.”

- Facebook

Page 44: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

“…only loading content from trusted sources into WebView will help protect users.”

- Adrian Ludwig, Google

Page 45: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

1. Navigate to untrusted content

Page 46: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

// In app codemyWebView.loadUrl(“foo.com”);

Page 47: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

// In app codemyWebView.load(“foo.com”);

<!-- In HTML --><a href=“foo.com”>click!</a>

Page 48: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

// In app codemyWebView.load(“foo.com”);

<!-- In HTML --><a href=“foo.com”>click!</a>

<!-- More HTML --><iframe src=“foo.com”/>

Page 49: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

// In app codemyWebView.loadUrl(“foo.com”);

<!-- In HTML --><a href=“foo.com”>click!</a>

<!-- More HTML --><iframe src=“foo.com”/>

// In JavaScriptwindow.location = “foo.com”;

Page 50: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

public boolean shouldOverrideUrlLoading( WebView view, String url){

// False -> Load URL in WebView // True -> Prevent the URL load

}

Page 51: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

public boolean shouldOverrideUrlLoading( WebView view, String url){

String host = new URL(url).getHost(); if(host.equals(“stanford.edu”)) return false; log(“Overrode URL: ” + url); return true;}

Page 52: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

public boolean shouldOverrideUrlLoading( WebView view, String url){

String host = new URL(url).getHost(); if(host.equals(“stanford.edu”)) return false; log(“Overrode URL: ” + url); return true;}

Page 53: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Reach Untrusted Content?

• 40,084 apps with full URLs and use JavaScript

Bridge

• 13,683 apps (34%) can reach untrusted

content

Page 54: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

What does untrusted mean?

Page 55: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Use HTTPS?

• 152,706 apps with partially computed URLs• 87,968 apps (57%) with HTTP URLs

Page 56: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Handling SSL Errors

onReceivedSslError

1. handler.proceed()2. handler.cancel()3. view.loadUrl(...)

Page 57: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Mishandling SSL Errors

• 117,974 apps implement onReceivedSslError

• 29,652 apps (25%) must ignore errors

Page 58: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Results

Page 59: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Vulnerability % Relevant % Vulnerable

Unsafe Nav 15 34

HTTP 40 56

Unsafe HTTPS 27 29

Primary results

Page 60: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Popularity

Page 61: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Outdated Apps

Page 62: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

29% unsafe nav

Libraries

51% HTTP

53% unsafe HTTPS

Page 63: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Additional security issuesAnalyze 998,286 free web apps from June 2014

Page 64: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Takeaways

• Apps must not load untrusted content into WebViews

• Able to identify violating apps using static analysis

• Vulnerabilities are present in the entire app ecosystem

Page 65: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Outline

• Mobile malware– Common cases involve command and control,

information theft• Identifying malware

– Detect at app store rather than on platform• Classification study of mobile web apps

– Entire Google Play market as of 2014– 85% of approx 1 million apps use web interface– 28% have at least one vulnerability

Page 66: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware
Page 67: Mobile Malware John Mitchell CS 155 Spring 2015. Outline Mobile malware – Common cases involve command and control, information theft Identifying malware

Summary

• Analyze a dataset of 737,828 Android apps • Found large number of apps contain severe vulnerabilities • 37,418 apps are vulnerable to a remote code execution

exploit when run on any Android device, because of security oversight in older versions and slow adoption of safe versions

• 45,689 apps are vulnerable to a remote code execution exploit when run on 73% of the in-use Android devices.

• Offer recommendations for developers who wish to avoid these vulnerabilities.