android malware that won t make you fall asleep
play

Android malware that wont make you fall asleep ukasz Siewierski - PowerPoint PPT Presentation

Sep 05, 2023 •186 likes •535 views

Android malware that wont make you fall asleep ukasz Siewierski lukasz.siewierski@cert.pl @maldr0id Hackito Ergo Sum 2015 Android malware is boring! ukasz Siewierski (@maldr0id) Android malware that wont make you fall asleep 2 / 24

  1. Android malware that won’t make you fall asleep Łukasz Siewierski lukasz.siewierski@cert.pl @maldr0id Hackito Ergo Sum 2015

  2. Android malware is boring! Łukasz Siewierski (@maldr0id) Android malware that won’t make you fall asleep 2 / 24

  3. Android malware is boring! Use of a standard API in a standard way – to extract information. Written in Java and obfuscated in an obvious and simple way. No creativity. Does what is expected. No (or very little of) social engineering. Usually, it doesn’t even have native code. No (interesting) targeted attacks. Overall, extremely boring. Łukasz Siewierski (@maldr0id) Android malware that won’t make you fall asleep 2 / 24

  4. Android malware is boring! Use of a standard API in a standard way – to extract information. Written in Java and obfuscated in an obvious and simple way. No creativity. Does what is expected. No (or very little of) social engineering. Usually, it doesn’t even have native code. No (interesting) targeted attacks. Overall, extremely boring. Łukasz Siewierski (@maldr0id) Android malware that won’t make you fall asleep 2 / 24

  5. Android Malware Tracker – amtrckr.info Łukasz Siewierski (@maldr0id) Android malware that won’t make you fall asleep 3 / 24

  6. The good stuff! Łukasz Siewierski (@maldr0id) Android malware that won’t make you fall asleep 4 / 24

  7. AndroidManifest – the XML that isn’t Did you know that... AndroidManifest.xml is not really an XML? 00000000 03 00 08 00 a8 1e 00 00 01 00 1c 00 78 0e 00 00 |............x...| 00000010 42 00 00 00 00 00 00 00 00 00 00 00 24 01 00 00 |B...........$...| 00000020 00 00 00 00 00 00 00 00 1a 00 00 00 34 00 00 00 |............4...| 00000030 52 00 00 00 5e 00 00 00 6a 00 00 00 78 00 00 00 |R...^...j...x...| 00000040 90 00 00 00 a2 00 00 00 b6 00 00 00 dc 00 00 00 |................| 00000050 ee 00 00 00 46 01 00 00 4a 01 00 00 5c 01 00 00 |....F...J..._ ..| 00000060 70 01 00 00 8c 01 00 00 96 01 00 00 aa 01 00 00 |p...............| 00000070 cc 01 00 00 06 02 00 00 50 02 00 00 a0 02 00 00 |........P.......| 00000080 f6 02 00 00 44 03 00 00 7c 03 00 00 c0 03 00 00 |....D...|.......| 00000090 12 04 00 00 4e 04 00 00 8c 04 00 00 d8 04 00 00 |....N...........| 000000a0 22 05 00 00 70 05 00 00 b2 05 00 00 fc 05 00 00 |"...p...........| 000000b0 36 06 00 00 84 06 00 00 c0 06 00 00 0e 07 00 00 |6...............| 000000c0 5a 07 00 00 ac 07 00 00 fe 07 00 00 54 08 00 00 |Z...........T...| 000000d0 8e 08 00 00 ce 08 00 00 12 09 00 00 58 09 00 00 |............X...| 000000e0 a8 09 00 00 ea 09 00 00 3e 0a 00 00 94 0a 00 00 |........>.......| 000000f0 ea 0a 00 00 04 0b 00 00 16 0b 00 00 3a 0b 00 00 |............:...| 00000100 Łukasz Siewierski (@maldr0id) 4e 0b 00 00 74 0b 00 00 92 0b 00 00 a2 0b 00 00 Android malware that won’t make you fall asleep |N...t...........| 5 / 24

  8. AndroidManifest.xml – StringPool 00000000 03 00 08 00 a8 1e 00 00 01 00 1c 00 78 0e 00 00 |............x...| 00000010 42 00 00 00 00 00 00 00 00 00 00 00 24 01 00 00 |B...........$...| 00000020 00 00 00 00 00 00 00 00 1a 00 00 00 34 00 00 00 |............4...| 00000030 52 00 00 00 5e 00 00 00 6a 00 00 00 78 00 00 00 |R...^...j...x...| 00000040 90 00 00 00 a2 00 00 00 b6 00 00 00 dc 00 00 00 |................| 00000050 ee 00 00 00 46 01 00 00 4a 01 00 00 5c 01 00 00 |....F...J..._ ..| 00000060 70 01 00 00 8c 01 00 00 96 01 00 00 aa 01 00 00 |p...............| 00000070 cc 01 00 00 06 02 00 00 50 02 00 00 a0 02 00 00 |........P.......| 00000080 f6 02 00 00 44 03 00 00 7c 03 00 00 c0 03 00 00 |....D...|.......| 00000090 12 04 00 00 4e 04 00 00 8c 04 00 00 d8 04 00 00 |....N...........| 000000a0 22 05 00 00 70 05 00 00 b2 05 00 00 fc 05 00 00 |"...p...........| 000000b0 36 06 00 00 84 06 00 00 c0 06 00 00 0e 07 00 00 |6...............| 000000c0 5a 07 00 00 ac 07 00 00 fe 07 00 00 54 08 00 00 |Z...........T...| 000000d0 8e 08 00 00 ce 08 00 00 12 09 00 00 58 09 00 00 |............X...| 000000e0 a8 09 00 00 ea 09 00 00 3e 0a 00 00 94 0a 00 00 |........>.......| 000000f0 ea 0a 00 00 04 0b 00 00 16 0b 00 00 3a 0b 00 00 |............:...| 00000100 4e 0b 00 00 74 0b 00 00 92 0b 00 00 a2 0b 00 00 |N...t...........| 00000110 f4 0b 00 00 46 0c 00 00 92 0c 00 00 a6 0c 00 00 |....F...........| 00000120 c4 0c 00 00 fc 0c 00 00 10 0d 00 00 0b 00 76 00 |..............v.| 00000130 65 00 72 00 73 00 69 00 6f 00 6e 00 43 00 6f 00 |e.r.s.i.o.n.C.o.| 00000140 64 00 65 00 00 00 0b 00 76 00 65 00 72 00 73 00 |d.e.....v.e.r.s.| 00000150 69 00 6f 00 6e 00 4e 00 61 00 6d 00 65 00 00 00 |i.o.n.N.a.m.e...| 00000160 0d 00 6d 00 69 00 6e 00 53 00 64 00 6b 00 56 00 |..m.i.n.S.d.k.V.| 00000170 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 04 00 |e.r.s.i.o.n.....| Łukasz Siewierski (@maldr0id) Android malware that won’t make you fall asleep 6 / 24

  9. AndroidManifest.xml – Strings 00000000 03 00 08 00 a8 1e 00 00 01 00 1c 00 78 0e 00 00 |............x...| 00000010 42 00 00 00 00 00 00 00 00 00 00 00 24 01 00 00 |B...........$...| 00000020 00 00 00 00 00 00 00 00 1a 00 00 00 34 00 00 00 |............4...| 00000030 52 00 00 00 5e 00 00 00 6a 00 00 00 78 00 00 00 |R...^...j...x...| 00000040 90 00 00 00 a2 00 00 00 b6 00 00 00 dc 00 00 00 |................| 00000050 ee 00 00 00 46 01 00 00 4a 01 00 00 5c 01 00 00 |....F...J..._ ..| 00000060 70 01 00 00 8c 01 00 00 96 01 00 00 aa 01 00 00 |p...............| 00000070 cc 01 00 00 06 02 00 00 50 02 00 00 a0 02 00 00 |........P.......| 00000080 f6 02 00 00 44 03 00 00 7c 03 00 00 c0 03 00 00 |....D...|.......| 00000090 12 04 00 00 4e 04 00 00 8c 04 00 00 d8 04 00 00 |....N...........| 000000a0 22 05 00 00 70 05 00 00 b2 05 00 00 fc 05 00 00 |"...p...........| 000000b0 36 06 00 00 84 06 00 00 c0 06 00 00 0e 07 00 00 |6...............| 000000c0 5a 07 00 00 ac 07 00 00 fe 07 00 00 54 08 00 00 |Z...........T...| 000000d0 8e 08 00 00 ce 08 00 00 12 09 00 00 58 09 00 00 |............X...| 000000e0 a8 09 00 00 ea 09 00 00 3e 0a 00 00 94 0a 00 00 |........>.......| 000000f0 ea 0a 00 00 04 0b 00 00 16 0b 00 00 3a 0b 00 00 |............:...| 00000100 4e 0b 00 00 74 0b 00 00 92 0b 00 00 a2 0b 00 00 |N...t...........| 00000110 f4 0b 00 00 46 0c 00 00 92 0c 00 00 a6 0c 00 00 |....F...........| 00000120 c4 0c 00 00 fc 0c 00 00 10 0d 00 00 0b 00 76 00 |..............v.| 00000130 65 00 72 00 73 00 69 00 6f 00 6e 00 43 00 6f 00 |e.r.s.i.o.n.C.o.| 00000140 64 00 65 00 00 00 0b 00 76 00 65 00 72 00 73 00 |d.e.....v.e.r.s.| 00000150 69 00 6f 00 6e 00 4e 00 61 00 6d 00 65 00 00 00 |i.o.n.N.a.m.e...| 00000160 0d 00 6d 00 69 00 6e 00 53 00 64 00 6b 00 56 00 |..m.i.n.S.d.k.V.| 00000170 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 04 00 |e.r.s.i.o.n.....| Łukasz Siewierski (@maldr0id) Android malware that won’t make you fall asleep 7 / 24

  10. AndroidManifest.xml – ResourceMap 00000e50: 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 61 00 n.t.e.n.t...c.a. 00000e60: 74 00 65 00 67 00 6f 00 72 00 79 00 2e 00 4c 00 t.e.g.o.r.y...L. 00000e70: 41 00 55 00 4e 00 43 00 48 00 45 00 52 00 00 00 A.U.N.C.H.E.R... 00000e80: 80 01 08 00 30 00 00 00 1b 02 01 01 1c 02 01 01 ....0........... 00000e90: 0c 02 01 01 03 00 01 01 02 00 01 01 01 00 01 01 ................ 00000ea0: 0f 00 01 01 0e 00 01 01 1c 00 01 01 1e 00 01 01 ................ 00000eb0: 00 01 10 00 18 00 00 00 02 00 00 00 ff ff ff ff ................ 00000ec0: 0a 00 00 00 0b 00 00 00 02 01 10 00 60 00 00 00 ............‘... 00000ed0: 02 00 00 00 ff ff ff ff ff ff ff ff 0e 00 00 00 ................ 00000ee0: 14 00 14 00 03 00 00 00 00 00 00 00 0b 00 00 00 ................ 00000ef0: 00 00 00 00 ff ff ff ff 08 00 00 10 01 00 00 00 ................ 00000f00: 0b 00 00 00 01 00 00 00 10 00 00 00 08 00 00 03 ................ 00000f10: 10 00 00 00 ff ff ff ff 0d 00 00 00 0f 00 00 00 ................ 00000f20: 08 00 00 03 0f 00 00 00 02 01 10 00 38 00 00 00 ............8... 00000f30: 07 00 00 00 ff ff ff ff ff ff ff ff 11 00 00 00 ................ 00000f40: 14 00 14 00 01 00 00 00 00 00 00 00 0b 00 00 00 ................ 00000f50: 02 00 00 00 ff ff ff ff 08 00 00 10 07 00 00 00 ................ 00000f60: 03 01 10 00 18 00 00 00 07 00 00 00 ff ff ff ff ................ 00000f70: ff ff ff ff 11 00 00 00 02 01 10 00 38 00 00 00 ............8... 00000f80: 08 00 00 00 ff ff ff ff ff ff ff ff 12 00 00 00 ................ 00000f90: 14 00 14 00 01 00 00 00 00 00 00 00 0b 00 00 00 ................ 00000fa0: 03 00 00 00 13 00 00 00 08 00 00 03 13 00 00 00 ................ 00000fb0: 03 01 10 00 18 00 00 00 08 00 00 00 ff ff ff ff ................ 00000fc0: ff ff ff ff 12 00 00 00 02 01 10 00 38 00 00 00 ............8... Łukasz Siewierski (@maldr0id) Android malware that won’t make you fall asleep 8 / 24

  11. AndroidManifest.xml – Resource ID and String 0 (0x0101021b): versionCode 1 (0x0101021c): versionName 2 (0x0101020c): minSdkVersion 3 (0x01010003): name 4 (0x01010002): icon 5 (0x01010001): label 6 (0x0101000f): debuggable 7 (0x0101000e): enabled 8 (0x0101001c): priority 9 (0x0101001e): screenOrientation 10 (): android 11 (): http://schemas.android.com/apk/res/android 12 (): 13 (): package 14 (): manifest 15 (): com.security 16 (): 4.3 https://android.googlesource.com/platform/frameworks/base/+/master/core/res/res/ values/public.xml Łukasz Siewierski (@maldr0id) Android malware that won’t make you fall asleep 9 / 24

Recommend

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Falling asleep within minutes Staying asleep throughout the night (or fall back asleep

Falling asleep within minutes Staying asleep throughout the night (or fall back asleep

Falling asleep within minutes Staying asleep throughout the night (or fall back asleep with ease) Waking without much trouble Not feeling drowsy during the day Sleep problems = skill deficit Sleep is influenced by

642 views • 60 slides
StormDroid: A streaminglized Machine Learning-Based System for Detecting Android Malware Sen

StormDroid: A streaminglized Machine Learning-Based System for Detecting Android Malware Sen

StormDroid: A streaminglized Machine Learning-Based System for Detecting Android Malware Sen Chen, Minhui Xue, Zhushou Tang, Lihua Xu, Haojin Zhu Malware Detection in Android 1.6 million apps in Google Play Store in July 2015

441 views • 22 slides
ANDROID MALWARE https://www.cnet.com/android-update/ Rafael Estrada Department of Mathematics

ANDROID MALWARE https://www.cnet.com/android-update/ Rafael Estrada Department of Mathematics

DATA ANALYSIS OF ANDROID MALWARE https://www.cnet.com/android-update/ Rafael Estrada Department of Mathematics New Mexico Tech Mentor: Dr. Golden G. Richard III Postdoctoral Researcher: Aisha Ali-Gombe July 26 th 2017 CCT REU 2017 ANDROID

347 views • 10 slides
Developers Google Maps Android API v2 Make your Android app pop with Google Maps Android API v2

Developers Google Maps Android API v2 Make your Android app pop with Google Maps Android API v2

Developers Google Maps Android API v2 Make your Android app pop with Google Maps Android API v2 Anthony Morris Jan-Felix Schmakeit Tech Lead, Android Maps API Android Developer Relations Code, Slides, Worksheet: http://goo.gl/MfY67 Welcome!

687 views • 49 slides
Android Pre-requisites 1 Android To Dos Make sure you have working

Android Pre-requisites 1 Android To Dos Make sure you have working

Android Pre-requisites 1 Android To Dos Make sure you have working install of Android Studio Make sure it works by running Hello, world App On emulator

666 views • 24 slides
Narrator:When Jackey is having a chemistry lesson, he began to fall asleep. It seems that he is

Narrator:When Jackey is having a chemistry lesson, he began to fall asleep. It seems that he is

Stage1(jackey feels asleep) Narrator:When Jackey is having a chemistry lesson, he began to fall asleep. It seems that he is having a terrible dream. lets see what happen to him. Jackey:(Jackey screams) Help! Help! Miss Ding, please let me go!

168 views • 5 slides
Dissecting Android Malware: Characterization and Evolution 1 Problems to solve 18 Requirement

Dissecting Android Malware: Characterization and Evolution 1 Problems to solve 18 Requirement

Dissecting Android Malware: Characterization and Evolution 1 Problems to solve 18 Requirement 1: Sufficient Malware data set Anti Virus Communities or Researchers are hampered by the lack of malware data set. Req equires a a suf

648 views • 34 slides
Apposcopy: Semantics- Based Detection of Android Malware through Static Analysis By Feng et al

Apposcopy: Semantics- Based Detection of Android Malware through Static Analysis By Feng et al

Apposcopy: Semantics- Based Detection of Android Malware through Static Analysis By Feng et al [FSE 14] Presented by Maaz Ahmad The Malware Problem (Feb, 2015) Motive Security Labs estimates 16 million infected mobile devices. [1]

828 views • 30 slides
MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models Enrico

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models Enrico

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models Enrico Mariconti , Lucky Onwuzurike, Panagiotis Andriotis, Emiliano De Cristofaro, Gordon Ross, Gianluca Stringhini. NDSS 2017, 28-02-2017 Motivation: Android

1.21k views • 37 slides
GroDDViewer: Dynamic dual view of Android malware Jean-Franois Lalande Mathieu Simon Valrie

GroDDViewer: Dynamic dual view of Android malware Jean-Franois Lalande Mathieu Simon Valrie

Introduction Malware analysis Visualization Conclusion GroDDViewer: Dynamic dual view of Android malware Jean-Franois Lalande Mathieu Simon Valrie Viet Triem Tong GraMSec 2020 CIDRE team June 22th 2020 Introduction Malware analysis

530 views • 28 slides
Andrubis 1,000,000 Apps Later A View on Current Android Malware Behaviors Martina

Andrubis 1,000,000 Apps Later A View on Current Android Malware Behaviors Martina

Andrubis 1,000,000 Apps Later A View on Current Android Malware Behaviors Martina Lindorfer, Matthias Neugschwandtner, Lukas Weichselbaum, Yanick Fratantonio, Victor van der Veen, Christian Platzer Vienna University of

425 views • 31 slides
APPLICATIONS UDAY LINGALA CSCI 5448, Fall 2012 Content Introduction to Android system

APPLICATIONS UDAY LINGALA CSCI 5448, Fall 2012 Content Introduction to Android system

ANDROID AND ANDROID APPLICATIONS UDAY LINGALA CSCI 5448, Fall 2012 Content Introduction to Android system What is android? History Android Market Why Android Design philosophy System Architecture Features

802 views • 40 slides
SigPID: Significant Permission Identification for Android Malware Detection Authors: Lichao Sun,

SigPID: Significant Permission Identification for Android Malware Detection Authors: Lichao Sun,

SigPID: Significant Permission Identification for Android Malware Detection Authors: Lichao Sun, Zhiqiang Li, Qiben Yan, Witawas Srisa-an and Yu Pan Department of Computer Science and Engineering University of Nebraska Lincoln Presenters: Yu

999 views • 24 slides
Lecture 11 Malware Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017

Lecture 11 Malware Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017

Lecture 11 Malware Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides adapted from Michael Bailey Malware definition and goals What is malware? Set of instructions that run on your computer and do

769 views • 41 slides
CS 2302, Fall 2014 Graphics Concepts Drawing in Android 11/17/2014 2 Android Alternatives

CS 2302, Fall 2014 Graphics Concepts Drawing in Android 11/17/2014 2 Android Alternatives

CS 2302, Fall 2014 Graphics Concepts Drawing in Android 11/17/2014 2 Android Alternatives Android provides several ways to create graphic images Drawable objects Defined by program code Defined in resource files Can be

414 views • 25 slides
Obfuscated Financial Fraud Android Malware : Detection and Behavior Tracking In Seung, Yang

Obfuscated Financial Fraud Android Malware : Detection and Behavior Tracking In Seung, Yang

Obfuscated Financial Fraud Android Malware : Detection and Behavior Tracking In Seung, Yang (KrCERT/CC, KISA) DeepSEC IDSC 2016 Friday, 11 November 2016 Analysis Team at KrCERT/CC, KISA Mobile malware analyst In Seung, Yang Who am I

1.59k views • 72 slides
AppSpear: Bytecode Decryp0ng and DEX Reassembling for Packed Android Malware Yang Wenbo, Zhang

AppSpear: Bytecode Decryp0ng and DEX Reassembling for Packed Android Malware Yang Wenbo, Zhang

AppSpear: Bytecode Decryp0ng and DEX Reassembling for Packed Android Malware Yang Wenbo, Zhang Yuanyuan, Li Juanru, Shu Junliang, Li Bodong, Hu Wenjun, Gu Dawu Sudeep Nanjappa Jayakumar Agenda Introduc0on AppSpear Goals,

322 views • 19 slides
DroidScribe Classifying Android Malware Based on Runtime Behavior Santanu Kumar Dash, Guillermo

DroidScribe Classifying Android Malware Based on Runtime Behavior Santanu Kumar Dash, Guillermo

DroidScribe Classifying Android Malware Based on Runtime Behavior Santanu Kumar Dash, Guillermo Suarez-Tangil , Salahuddin Khan, Kimberly Tam, Mansour Ahmadi, Johannes Kinder, and Lorenzo Cavallaro Royal Holloway, University of London

352 views • 33 slides
AVPASS: Automatically Bypassing Android Malware Detection System Jinho Jung, Chanil Jeon, Max

AVPASS: Automatically Bypassing Android Malware Detection System Jinho Jung, Chanil Jeon, Max

AVPASS: Automatically Bypassing Android Malware Detection System Jinho Jung, Chanil Jeon, Max Wolotsky, Insu Yun, and Taesoo Kim Georgia Institute of Technology, July 27, 2017 Ab About t Us SSLab (@GT) Focusing on s ystem and security

1.25k views • 72 slides
Part 1: Setup Google Map API for Android Prerequisites Please make sure that you can deploy a

Part 1: Setup Google Map API for Android Prerequisites Please make sure that you can deploy a

11/12/13 Setup Google Map API for Android Setup Google Map API for Android Part 1: Setup Google Map API for Android Prerequisites Please make sure that you can deploy a regular Android App on your device. See instructions if you did not finish

384 views • 6 slides
Kharon dataset: Android malware under a microscope Nicolas Kiss Jean-Franois Lalande Mourad

Kharon dataset: Android malware under a microscope Nicolas Kiss Jean-Franois Lalande Mourad

Kharon dataset: Android malware under a microscope Nicolas Kiss Jean-Franois Lalande Mourad Leslous Valrie Viet Triem Tong The LASER Workshop 2016 Learning from Authoritative Security Experiment Results May 26th 2016 N. Kiss & J.-F.

367 views • 18 slides
DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android

DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android

DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis Lok Yan Heng Yin August 10, 2012 1 Android Java Components System Services Native Components Apps 2 Android Java Components

631 views • 33 slides

More recommend