HOOKER A solution to analyze Android markets Dimitri Kirchner - PowerPoint PPT Presentation

HOOKER A solution to analyze Android markets Dimitri Kirchner – @Tibapbedoum Georges Bossert – @Lapeluche AMOSSYS

PhD candidate AMOSSYS / Supelec IT security engineer AMOSSYS Protocole Reverse Engineering Android Hooker: a solution to analyze Android markets 2

IT security engineer at AMOSSYS since 2010 Android Informatique de confiance Hooker: a solution to analyze Android markets 3

Hooker: a solution to analyze Android markets 4

Hooker: a solution to analyze Android markets 5

Hooker: a solution to analyze Android markets 6

Hooker: a solution to analyze Android markets 7

8

Android security model Ask the user for permissions in order to access phones ressources (texts, GPS, etc.) Hooker : a solution to analyze your Android market 9

Hooker: a solution to analyze Android markets 10

Hooker: a solution to analyze Android markets 11

Hooker: a solution to analyze Android markets 12

Hooker: a solution to analyze Android markets 13

Let’s say, I really need this app … What the application does with its ressources ? Are resources really used by the application ? Are resources used in a legitimate way ? Hooker: a solution to analyze Android markets 14

You already have solutions for that Static versus dynamic analysis tools Hooker: a solution to analyze Android markets 15

Androguard JD-Core/GUI Etc. Hooker: a solution to analyze Android markets 16

Dynamic analysis Solution 1: Build a custom Android ROM (Droidbox) to instrument the kernel Hooker: a solution to analyze Android markets 17

Dynamic analysis Solution 1: Build a custom Android ROM (Droidbox) to instrument the kernel Solution 2: Modify APK before install (APIMonitor / Fino) to instrument the APK Hooker: a solution to analyze Android markets 18

Dynamic analysis Solution 1: Build a custom Android ROM (Droidbox) to instrument the kernel Solution 2: Modify APK before install (APIMonitor / Fino) to instrument the APK Solution 3: API hooking framework (Substrate / Xposed) Hooker: a solution to analyze Android markets 19

Online scanners Mix of static and dynamic Fancy user interface and reports Hooker: a solution to analyze Android markets 20

Hooker: a solution to analyze Android markets 21

Analysis are centered on one application Is it possible to analyze more than one application ? Can you analyze an entire market ? Hooker: a solution to analyze Android markets 22

Introducing hooker Hooker: a solution to analyze Android markets 23

What is Hooker A solution to analyze Android applications Centralize and aggregate analysis of thousands of differents applications Hooker: a solution to analyze Android markets 24

How Hooker works Microanalysis versus Macroanalysis Hooker: a solution to analyze Android markets 26

How Hooker works Microanalysis versus Macroanalysis Hooker: a solution to analyze Android markets 27

How Hooker works Microanalysis versus Macroanalysis Analysis of several applications Hooker: a solution to analyze Android markets 28

Microanalysis overview Hooker: a solution to analyze Android markets 29

Rule n1: Gather all possible information about the application behavior Hooker : a solution to analyze your Android market 30

Step 1: Androguard It just works great Framework in python Let us extract basic information about the application Package name Permissions Services Etc. Hooker: a solution to analyze Android markets 31

Step 2: Substrate An API hooking framework Changes behavior of one application, without patches, or specific ROM, or whatever What you need is: Root access Compatible Android version Hooker: a solution to analyze Android markets 32

Substrate Injects code into Zygote process (father of all processes) Therefore, injected in all spawned processes (Similar to Xposed) Hooker: a solution to analyze Android markets 33

Use Substrate to: Hook access to personal information (read contacts, etc.) Hook access to specific API (open socket) Modify return of specific methods (anti-anti-emulation) Hooker: a solution to analyze Android markets 34

Hook PowerManager methods Hooker: a solution to analyze Android markets 35

Hook PowerManager methods Methods name Hooker: a solution to analyze Android markets 36

Build events in real time Hooker: a solution to analyze Android markets 37

Build events in real time Hooker: a solution to analyze Android markets 38

Build events in real time Hooker: a solution to analyze Android markets 39

Intrusive level indicator Differentiates critical event from normal event Writing is considered more intrusive than reading Application doing lots of intrusive events is highlighted Hooker: a solution to analyze Android markets 40

Hooker: a solution to analyze Android markets 41

Hooker: a solution to analyze Android markets 42

Hooker: a solution to analyze Android markets 43

Hooker: a solution to analyze Android markets 44

Main limitation White list enumeration We don’t intercept what we don’t declare Hooker: a solution to analyze Android markets 45

Main limitation White list enumeration We don’t intercept what we don’t declare Hooker: a solution to analyze Android markets 46

Hooker: a solution to analyze Android markets 47

Hooker: a solution to analyze Android markets 48

Store events in a distributed database Elastic search Interact with database Kibana (front-end) Hooker: a solution to analyze Android markets 49

Hooker : a solution to analyze your Android market 50

You have to build your own Kibana interface Basic malware generates 2000 events in 60 seconds Hooker: a solution to analyze Android markets 51

Macroanalysis Hooker: a solution to analyze Android markets 52

Macroanalysis Automation and parallelization of microanalysis Hooker: a solution to analyze Android markets 53

Macroanalysis Automation and parallelization of microanalysis Look for specific patterns in thousands of applications Hooker: a solution to analyze Android markets 54

Macroanalysis Automation and parallelization of microanalysis Look for specific patterns in thousands of applications Post analysis Hooker: a solution to analyze Android markets 55

Macroanalysis Automation and parallelization of microanalysis Look for specific patterns in thousands of applications Post analysis Data mining Hooker: a solution to analyze Android markets 56

Automation Step 1: Prepare an Android emulator Step 2: Configure a scenario Install Execute Stimulate External stimulation Reboot Hooker: a solution to analyze Android markets 57

Automation Step 1: Prepare an Android emulator Step 2: Configure a scenario Install Execute Stimulate External stimulation Reboot Hooker: a solution to analyze Android markets 58

Automation Step 1: Prepare an Android emulator Step 2: Configure a scenario Install Execute Stimulate External stimulation Reboot Hooker: a solution to analyze Android markets 59

Automation Step 1: Prepare an Android emulator Step 2: Configure a scenario Install Execute Stimulate External stimulation Phone call SMS reception Reboot GPS stimulation, etc. Hooker: a solution to analyze Android markets 60

Step 3: Run the experiment $ python hooker_xp.py – c automaticAnalysis.conf Wait and see Hooker: a solution to analyze Android markets 61

Post-analysis Python script to query Elasticseach database Query what you want to make: Statistics • Hightlights • Hooker: a solution to analyze Android markets 62

Get thousands of APKs Google store Unofficial markets APK in archives Hooker: a solution to analyze Android markets 63

Get thousands of APKs Google store Unofficial markets APK in archives What we have tried until now: 1000 apps from SlideMe market in the paper 1000 apps from Google store Hooker: a solution to analyze Android markets 64

Network statistics Hooker : a solution to analyze your Android market 65

Most used Network methods getFile sendto recvfrom execute getAuthority getInputStream IOException getSettings getOutputStream URL Socket openConnection getHost closeSocket getPort close connect getProtocol setCertificate 0 50 100 150 200 250 300 Number of applications Hooker : a solution to analyze your Android market 66

Internet permissions 477 apps asking for internet permissions 404 have been found using it Hooker: a solution to analyze Android markets 67

Domains most accessed www.google-analytics.com mm.admob.com googleads.g.doubleclick.net www.google.com ade.wooboo.com.cn secure.gameloft.com 0 10 20 30 40 Number of applications Hooker : a solution to analyze your Android market 68

Domains most accessed www.google-analytics.com mm.admob.com googleads.g.doubleclick.net www.google.com Advertisements ade.wooboo.com.cn secure.gameloft.com 0 10 20 30 40 Number of applications Hooker : a solution to analyze your Android market 69