Android Malware Exposed - An In-depth Look at its Evolution

Session ID: Session Classification:

Grayson Milbourne (@gmilbourne) Webroot, Inc.

MBS-R02 Intermediate

ANDROID MALWARE EXPOSED – AN IN-DEPTH LOOK AT ITS EVOLUTION

Agenda

▶ Trends of 2013 ▶  OS releases ▶  OS diversity and adoption ▶  Industry awareness ▶  Breaking news

▶ Evolutions in Android malware ▶  Threat vectors ▶  Popular malware permissions ▶  Source code behaviors ▶  SMS Trojans, botnets, spyware & adware

▶ Predictions for 2013/2014 ▶ Q&A

Trends of 2013

Trends of 2013 – OS Releases

▶ Google’s last two major OS releases added a number of security focused improvements ▶  Ice Cream Sandwich – December, 2011

▶ Full device encryption ▶ Introduced ASLR ▶ Data transfer controls

▶  Jelly Bean – July, 2012 – July, 2013 ▶ Built in bouncer / VirustTotal acquistion ▶ Premium SMS send alerts ▶ External storage permissions ▶ SELinux ▶ Always on VPN ▶ Master key exploit !x

Trends of 2013 – OS Diversity/Adoption

Jellybean

Ice Cream Sandwich

Gingerbread

v4.1 – 4.3

v2.3 v2.2

Trends of 2013 – Industry Awareness

▶ Do Companies realize the risk? ▶  59% agree mobile devices create a high security risk ▶  49% think mobile device security is a high priority

▶ What are companies concerned with? ▶  74% are very concerned with data loss/protection ▶  70% are very concerned with mobile malware

▶ How are companies impacted? ▶  43% reported lost or stolen devices ▶  23% reported malware infected devices

▶ How fast has Android malware grown? ▶  January 2012 – 13k samples, January 2013 – 180k samples ▶  September 2013 – 650k samples + 615k PUA

Trends of 2013 – Breaking News

Q3-12 •  Do-it-yourself Android malware tools •  Rogue AV’s now on Android

Q4-12 •  Drive-by-downloads target Android devices •  FBI warning to mobile device users

Q1-13 •  Red-October mobile module - iOS, Win Mobile, Nokia •  Google Play app downloads Windows malware

Q2-13 •  DIY tools for infecting legit Android apps with botnet code •  Increase in malicious Android banking app discoveries

Q3-13 •  ‘Master key’ exploit discovered impacting 99% of devices •  Affiliate networks impersonate Google Play -> SMS Trojans

Evolutions in Android Malware

Threat Vectors

▶ Rogue applications ▶ System folder install ▶ Polymorphic distribution ▶ Payload encryption ▶ Security app removal ▶ Embedded payloads

▶ Rogue applications ▶  Infected applications ▶ SMS phishing ▶ Man-in-the-mobile ▶ Website drive-by ▶ QR code ▶ Rogue Android markets

Social-Engineering Evasion Tactics

Popular Malware Permissions

22.08% 22.40% 26.80%

51.41% 56.12% 58.62% 59.81% 62.51% 62.81% 63.45% 67.34% 70.32% 73.37% 76.73%

95.25% 96.97% 99.52%

CHANGE_WIFI_STATE

WRITE_APN_SETTINGS

GET_TASKS

WAKE_LOCK

READ_SMS

RECEIVE_SMS

ACCESS_FINE_LOCATION

SEND_SMS

ACCESS_COARSE_LOCATION

VIBRATE

WRITE_EXTERNAL_STORAGE

ACCESS_WIFI_STATE

INSTALL_SHORTCUT

RECEIVE_BOOT_COMPLETED

READ_PHONE_STATE

ACCESS_NETWORK_STATE

INTERNET

Targeted Source Code Behaviors

Exynos Exploit, 1.00%

AirPush, 38.77%

GoldDream, 1.00%

Yzhcsms, 1.00%

Reads IMEI, 63.74%

FakeInst 1161#, 1.00%

Gets IMSI Number, 22.53%

Gappusin, 1.00%

Mania, 1.00%

Leadbolt, 19.21%

Iconosys, 2.00%

Contacts Email Address Info, 1.60%

Get IP Address, 16.47%

SMS.Agent, 2.00% Contacts Data Table, 3.70%

Sends SMS, 9.04%

Rage Against the Cage, 5.70%

Accesses Contacts, 7.20%

GingerMaster.b, 2.15%

Contacts Phone Numbers, 2.52%

SMS Trojans

▶ First detected in the summer of 2010 ▶ Alias: FAkeInst, SMSSend, Boxer, OpFake ▶ Variants: FakePlayer, RuFraud, Foncy ▶ Accounts for more than half of android malware ▶ Sends premium rate SMS ▶ Google Play – 3rd party markets – rogue markets ▶ Fake apps – fake markets

SMS Trojans - Then

SMS Trojans Now – Pay for Play

▶ Sending up to 2 SMS messages to a short number: ▶  In France:

▶  81015 (€3.00) ▶  81085 (€4.50)

▶  In the UK: ▶  69067 (£2.00) ▶  79067 (£5.01)

SMS Trojans – Hiding Their Tracks

▶ Package names ▶  com.software.update ▶  opera.updater ▶  lbjwhhtdin.veuenar ▶  com.arche.NEED_FOR_SPEED_Shift

▶ Rogue market places ▶  Reviews, forums

▶  In!ltrate Google Play ▶  RuFraud

SMS Trojans – Hiding Their Tracks

Privacy

▶ Functionality used by legit, gray and malicious apps ▶ Monitor behaviors

▶  Voice ▶  SMS ▶  Location ▶  Contacts ▶  Camera ▶  Browser

Commercial Spyware

▶ Tracks usage: phone, location, SMS, mic, camera ▶ Hidden from device owner, runs as a service, no icon

Blackhat Spyware

▶ NickiSpy, FinSpy, GoManag, GGTracker

▶ ZitMo (Zeus) ▶ SpitMo (SpyEye)

Man-in-the-Mobile (MitMo)

Botnets

▶ Adds device to bot network ▶ Botnet activities:

▶  Spam ▶  Click-fraud ▶  SMS ▶  Data leakage ▶  DDoS

Botnets - Then

▶ Geinimi – discovered December 2010

▶ Command & control, steals personal info

▶ Found on Google Play

Botnets - Now

▶ Foncy IRC bot – January 2012 ▶ Rooter, command & control, SMS

Botnets - Now

▶ Mdk/Simple Temai – Spetember 2012 – January 2013 ▶ Comand & control, SMS, spam, downloader

Advertising - Then

▶ Accepted ▶ Supports free apps ▶ Non-intrusive ▶ No extra permissions

Advertising - Now

▶ Aggressive advertising ▶ Noti!cation bar, shortcuts, bookmarks

Advertising – Google Takes Action

Advertising - Now

▶ Misleading advertisements

Future Predictions

▶ SMiShing (SMS-phishing): Consumers continue to get tricked by texts that appear as urgent, legitimate calls-to-action

▶ Ransomware: These Trojans block access to device functionality as a method to exploit users

▶ Premium-SMS Trojans: These pro!table Trojans secretly call or text premium numbers

▶ Banking attacks: Expect an increase on banking attacks in the form of man-in-the-middle attacks and capturing SMS messages

▶ Drive-by-downloads: Expect exploit kits to include modules speci!cally for smart devices

Thank you! Grayson Milbourne

Webroot, Inc. @gmilbourne

gmilbourne@webroot.com www.webroot.com

Android Malware Exposed - An In-depth Look at its Evolution

Documents

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Essence of Advanced Persistent Threats in 15 Minutes...MySQL.com Spreading Fake Antivirus The Register: MySQL.com breach leaves visitors exposed to malware, September 26, 2011

Booklet - Modern Malware Exposed

Malware & Anti-Malware

Metamorphic Malware 1 Metamorphic Malware Research

Reversing malware analysis trainingpart9 advanced malware analysis

DB2 z/OS Audit usingthey are increasingly exposed to malware. Web services on the mainframe have significantly impacted security” President, Mittal Technologies Inc. Source: IBM

Process Out-Grafting: An Efﬁcient “Out-of-VM” Approach for ... · Recent rapid malware growth has exposed the limitations of traditional in-host malware-defense systems and

Windows Malware Firewall: Remove Windows Malware Firewall

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Hacking exposed malware and rootkits

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Evasive Malware Exposed and Deconstructed - RSA … · Evasive Malware Exposed and Deconstructed Chief Scientist Lastline, Inc. CRWD-T08 . #RSAC Who am I? ... Also known as malware

PALO ALTO NETWORKS: Content-ID Technology Brief...and repeatedly flow across the network. Additionally, enterprises are exposed to targeted and customized malware, which may pass undetected

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Malware Defense-in-Depth 2.0

Nearly 400 Dairy Queen Locations Infected with Backoff Malware · 2014-11-13 · 300 Stores in 20 States Infected with Malware Payment Card Data Exposed

Advanced malware detection through threat intelligence•Malicious code is becoming more difficult to detect •A lack of anti -virus products signatures leave our network exposed

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Android Malware Exposed - Webroot · An In-depth Look at the Evolution of Android Malware Android Security ... We will discuss the tools used for analysis along ... “Android Malware