• Home

  • Documents

  • Android Malware Exposed - An In-depth Look at its Evolution
33
Session ID: Session Classification: Grayson Milbourne (@gmilbourne) Webroot, Inc. MBS-R02 Intermediate ANDROID MALWARE EXPOSED – AN IN-DEPTH LOOK AT ITS EVOLUTION

Android Malware Exposed - An In-depth Look at its Evolution

Embed Size (px)

Citation preview

Page 1: Android Malware Exposed - An In-depth Look at its Evolution

Session ID: Session Classification:

Grayson  Milbourne  (@gmilbourne)  Webroot, Inc.

MBS-R02 Intermediate

ANDROID MALWARE EXPOSED – AN IN-DEPTH LOOK AT ITS EVOLUTION

Page 2: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Agenda

▶ Trends of 2013 ▶  OS releases ▶  OS diversity and adoption ▶  Industry awareness ▶  Breaking news

▶ Evolutions in Android malware ▶  Threat vectors ▶  Popular malware permissions ▶  Source code behaviors ▶  SMS Trojans, botnets, spyware & adware

▶ Predictions for 2013/2014 ▶ Q&A

Page 3: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Trends of 2013

Page 4: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Trends of 2013 – OS Releases

▶ Google’s last two major OS releases added a number of security focused improvements ▶  Ice Cream Sandwich – December, 2011

▶ Full device encryption ▶ Introduced ASLR ▶ Data transfer controls

▶  Jelly Bean – July, 2012 – July, 2013 ▶ Built in bouncer / VirustTotal acquistion ▶ Premium SMS send alerts ▶ External storage permissions ▶ SELinux ▶ Always on VPN ▶ Master key exploit !x

Page 5: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Trends of 2013 – OS Diversity/Adoption

Jellybean

Ice Cream Sandwich

Gingerbread

Froyo

v4.0

v4.1 – 4.3

v2.3 v2.2

v2.1

v1.6

v1.5

Page 6: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Trends of 2013 – Industry Awareness

▶ Do Companies realize the risk? ▶  59% agree mobile devices create a high security risk ▶  49% think mobile device security is a high priority

▶ What are companies concerned with? ▶  74% are very concerned with data loss/protection ▶  70% are very concerned with mobile malware

▶ How are companies impacted? ▶  43% reported lost or stolen devices ▶  23% reported malware infected devices

▶ How fast has Android malware grown? ▶  January 2012 – 13k samples, January 2013 – 180k samples ▶  September 2013 – 650k samples + 615k PUA

Page 7: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Trends of 2013 – Breaking News

Q3-12 •  Do-it-yourself Android malware tools •  Rogue AV’s now on Android

Q4-12 •  Drive-by-downloads target Android devices •  FBI warning to mobile device users

Q1-13 •  Red-October mobile module - iOS, Win Mobile, Nokia •  Google Play app downloads Windows malware

Q2-13 •  DIY tools for infecting legit Android apps with botnet code •  Increase in malicious Android banking app discoveries

Q3-13 •  ‘Master key’ exploit discovered impacting 99% of devices •  Affiliate networks impersonate Google Play -> SMS Trojans

Page 8: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Evolutions in Android Malware

Page 9: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Threat Vectors

▶ Rogue applications ▶ System folder install ▶ Polymorphic distribution ▶ Payload encryption ▶ Security app removal ▶ Embedded payloads

▶ Rogue applications ▶  Infected applications ▶ SMS phishing ▶ Man-in-the-mobile ▶ Website drive-by ▶ QR code ▶ Rogue Android markets

Social-Engineering Evasion Tactics

Page 10: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Popular Malware Permissions

22.08%  22.40%  26.80%  

51.41%  56.12%  58.62%  59.81%  62.51%  62.81%  63.45%  67.34%  70.32%  73.37%  76.73%  

95.25%  96.97%  99.52%  

CHANGE_WIFI_STATE  

WRITE_APN_SETTINGS  

GET_TASKS  

WAKE_LOCK  

READ_SMS  

RECEIVE_SMS  

ACCESS_FINE_LOCATION  

SEND_SMS  

ACCESS_COARSE_LOCATION  

VIBRATE  

WRITE_EXTERNAL_STORAGE  

ACCESS_WIFI_STATE  

INSTALL_SHORTCUT  

RECEIVE_BOOT_COMPLETED  

READ_PHONE_STATE  

ACCESS_NETWORK_STATE  

INTERNET  

Page 11: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Targeted Source Code Behaviors

Exynos Exploit, 1.00%

AirPush, 38.77%

GoldDream, 1.00%

Yzhcsms, 1.00%

Reads IMEI, 63.74%

FakeInst 1161#, 1.00%

Gets IMSI Number, 22.53%

Gappusin, 1.00%

Mania, 1.00%

Leadbolt, 19.21%

Iconosys, 2.00%

Contacts Email Address Info, 1.60%

Get IP Address, 16.47%

SMS.Agent, 2.00% Contacts Data Table, 3.70%

Sends SMS, 9.04%

Rage Against the Cage, 5.70%

Accesses Contacts, 7.20%

GingerMaster.b, 2.15%

Contacts Phone Numbers, 2.52%

Page 12: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

SMS Trojans

▶ First detected in the summer of 2010 ▶ Alias: FAkeInst, SMSSend, Boxer, OpFake ▶ Variants: FakePlayer, RuFraud, Foncy ▶ Accounts for more than half of android malware ▶ Sends premium rate SMS ▶ Google Play – 3rd party markets – rogue markets ▶ Fake apps – fake markets

Page 13: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

SMS Trojans - Then

Page 14: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

SMS Trojans - Then

Page 15: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

SMS Trojans Now – Pay for Play

▶ Sending up to 2 SMS messages to a short number: ▶  In France:

▶  81015 (€3.00) ▶  81085 (€4.50)

▶  In the UK: ▶  69067 (£2.00) ▶  79067 (£5.01)

Page 16: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

SMS Trojans – Hiding Their Tracks

▶ Package names ▶  com.software.update ▶  opera.updater ▶  lbjwhhtdin.veuenar ▶  com.arche.NEED_FOR_SPEED_Shift

▶ Rogue market places ▶  Reviews, forums

▶  In!ltrate Google Play ▶  RuFraud

Page 17: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

SMS Trojans – Hiding Their Tracks

Page 18: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Privacy

▶ Functionality used by legit, gray and malicious apps ▶ Monitor behaviors

▶  Voice ▶  SMS ▶  Location ▶  Contacts ▶  Camera ▶  Browser

Page 19: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Commercial Spyware

▶ Tracks usage: phone, location, SMS, mic, camera ▶ Hidden from device owner, runs as a service, no icon

Page 20: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Blackhat Spyware

▶ NickiSpy, FinSpy, GoManag, GGTracker

Page 21: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

▶ ZitMo (Zeus) ▶ SpitMo (SpyEye)

Man-in-the-Mobile (MitMo)

Page 22: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Botnets

▶ Adds device to bot network ▶ Botnet activities:

▶  Spam ▶  Click-fraud ▶  SMS ▶  Data leakage ▶  DDoS

Page 23: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Botnets - Then

▶ Geinimi – discovered December 2010

▶ Command & control, steals personal info

▶ Found on Google Play

Page 24: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Botnets - Now

▶ Foncy IRC bot – January 2012 ▶ Rooter, command & control, SMS

Page 25: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Botnets - Now

▶ Mdk/Simple Temai – Spetember 2012 – January 2013 ▶ Comand & control, SMS, spam, downloader

Page 26: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Advertising - Then

▶ Accepted ▶ Supports free apps ▶ Non-intrusive ▶ No extra permissions

Page 27: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Advertising - Now

▶ Aggressive advertising ▶ Noti!cation bar, shortcuts, bookmarks

Page 28: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Advertising – Google Takes Action

Page 29: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Advertising - Now

▶ Misleading advertisements

Page 30: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Future Predictions

Page 31: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Future Predictions

▶ SMiShing (SMS-phishing): Consumers continue to get tricked by texts that appear as urgent, legitimate calls-to-action

▶ Ransomware: These Trojans block access to device functionality as a method to exploit users

▶ Premium-SMS Trojans: These pro!table Trojans secretly call or text premium numbers

▶ Banking attacks: Expect an increase on banking attacks in the form of man-in-the-middle attacks and capturing SMS messages

▶ Drive-by-downloads: Expect exploit kits to include modules speci!cally for smart devices

Page 32: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Q & A

Page 33: Android Malware Exposed - An In-depth Look at its Evolution

#RSAC

Thank  you!  Grayson Milbourne

Webroot, Inc. @gmilbourne

[email protected] www.webroot.com


DB2 z/OS Audit usingthey are increasingly exposed to malware. Web services on the mainframe have significantly impacted security” President, Mittal Technologies Inc. Source: IBM

DB2 z/OS Audit usingthey are increasingly exposed to malware. Web services on the mainframe have significantly impacted security” President, Mittal Technologies Inc. Source: IBM

Documents
PALO ALTO NETWORKS: Content-ID Technology Brief...and repeatedly flow across the network. Additionally, enterprises are exposed to targeted and customized malware, which may pass undetected

PALO ALTO NETWORKS: Content-ID Technology Brief...and repeatedly flow across the network. Additionally, enterprises are exposed to targeted and customized malware, which may pass undetected

Documents
Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Documents
Analisis dan Deteksi Malware Menggunakan Metode Malware

Analisis dan Deteksi Malware Menggunakan Metode Malware

Documents
Android Malware Exposed-Evolution of Android Malware

Android Malware Exposed-Evolution of Android Malware

Documents
INTERNET SECURITY THREAT REPORT …...83 Top-Ten Types of Information Exposed 87 E-CRIME & MALWARE 89 Value of Information Sold on Black Market 90 New Malware Variants 90 Email Malware

INTERNET SECURITY THREAT REPORT …...83 Top-Ten Types of Information Exposed 87 E-CRIME & MALWARE 89 Value of Information Sold on Black Market 90 New Malware Variants 90 Email Malware

Documents
Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
Essence of Advanced Persistent Threats in 15 Minutes...MySQL.com Spreading Fake Antivirus The Register: MySQL.com breach leaves visitors exposed to malware, September 26, 2011

Essence of Advanced Persistent Threats in 15 Minutes...MySQL.com Spreading Fake Antivirus The Register: MySQL.com breach leaves visitors exposed to malware, September 26, 2011

Documents
The exposed Tourmalinite veins which are exposed at the depth of 1 metre from the surface running West South directions

The exposed Tourmalinite veins which are exposed at the depth of 1 metre from the surface running West South directions

Documents
Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Documents
Process Out-Grafting: An Efficient “Out-of-VM” Approach for ... › ~zwang › files › ccs11.pdf · Recent rapid malware growth has exposed the limitations of traditional in-host

Process Out-Grafting: An Efficient “Out-of-VM” Approach for ... › ~zwang › files › ccs11.pdf · Recent rapid malware growth has exposed the limitations of traditional in-host

Documents
Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Documents
An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Documents
Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Documents
Evasive Malware Exposed and Deconstructed - RSA … · Evasive Malware Exposed and Deconstructed Chief Scientist Lastline, Inc. CRWD-T08 . #RSAC Who am I? ... Also known as malware

Evasive Malware Exposed and Deconstructed - RSA … · Evasive Malware Exposed and Deconstructed Chief Scientist Lastline, Inc. CRWD-T08 . #RSAC Who am I? ... Also known as malware

Documents
An In-Depth Look At the Lunar Crater Copernicus: Exposed ... · Exposed Mineralogy by High-Resolution Near-Infrared Spectroscopy, Icarus (2011), doi: 10.1016/j.icarus. 2011.02.023

An In-Depth Look At the Lunar Crater Copernicus: Exposed ... · Exposed Mineralogy by High-Resolution Near-Infrared Spectroscopy, Icarus (2011), doi: 10.1016/j.icarus. 2011.02.023

Documents
1 Automated malware audit service Automatischer Malware Audit

1 Automated malware audit service Automatischer Malware Audit

Documents
Malware Defense-in-Depth 2.0

Malware Defense-in-Depth 2.0

Technology
Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Documents
PIN-point control for analyzing malware - RECON.CXPIN-point control for analyzing malware!!!! Jason Jones REcon 2014 1. Me Sr Sec Research Analyst @ Arbor ... NOT an in-depth intro

PIN-point control for analyzing malware - RECON.CXPIN-point control for analyzing malware!!!! Jason Jones REcon 2014 1. Me Sr Sec Research Analyst @ Arbor ... NOT an in-depth intro

Documents
Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Documents
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Documents
In-depth malware analysis FORMBOOK - botconf.eu · Malware As A Service Ready-to-use malware sold/rent directly by the developer Used to be sold on hackforums[.]net by 'ng-Coder

In-depth malware analysis FORMBOOK - botconf.eu · Malware As A Service Ready-to-use malware sold/rent directly by the developer Used to be sold on hackforums[.]net by 'ng-Coder

Documents
OPPORTUNITIES, REQUIREMENTS AND ECOLOGICAL ......Factor Good Average bad Romania Exposure partial sheltered exposed exposed Waves 1 m From 1 to 3 m 3 m > 3m Depth > 30 m From

OPPORTUNITIES, REQUIREMENTS AND ECOLOGICAL ......Factor Good Average bad Romania Exposure partial sheltered exposed exposed Waves 1 m From 1 to 3 m 3 m > 3m Depth > 30 m From

Documents
Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Documents
OK Credential Phishing - Proofpoint, Inc....Informs a user’s risk profile if exposed to phishing or malware Automates response actions, such as step-up authentication, to protect

OK Credential Phishing - Proofpoint, Inc....Informs a user’s risk profile if exposed to phishing or malware Automates response actions, such as step-up authentication, to protect

Documents
Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Technology