Upload
dokhanh
View
215
Download
0
Embed Size (px)
Citation preview
DAVID WALKIEWICZ, MAIK MORGENSTERN
AVAR 2016
Anti Virus Industry‘sFuture Challenge:
PUA
08.05.2017 1AV Future Challenge: PUA
SECURITY ISSUES ARISING
PUA and SecurityWikipedia …
Security
• Install root certificate
• Provide an entry door for malware (through exploits)
• Causing issues on the system – leading the user to remove
/change the AV Software
• Keylogger/KeyGenerator/PasswordReader etc…
• ….
Basically is a potentially dangerous nuisance for the user and those
poor admins fixing their parents device every weekend
408.05.2017 AV Future Challenge: PUA
Monetization Non-objectionable means
Share/Trialware
SAAS or plain buying
Advertisement on product webpage (Help, Forum etc.)
Advertisement in products (App Stores apps)
Non aggressive bundling
508.05.2017
EVERYBODY’S GOT TO EAT
Questionable means
Distribution through bundlers
Information Harvesting
Aggressive Advertisement
AV Future Challenge: PUA
SOME PRETTY PICTURES – PUA BEHAVIOR
608.05.2017
Sources
* http://www.cracksfiles.com/2015/01/universal-keygen-generator-2015-software/
* http://www.nirsoft.net/utils/mailpv.html
* http://deletemalware.blogspot.de/2012/01/pupcnetadwarebundle-uninstall-guide.html
* http://www.focus.de/digital/internet/anleitung-fuer-alle-browser-toolbar-ausversehen-installiert-so-werden-sie-die-leiste-wieder-los_id_4143166.html
AV Future Challenge: PUA
DISTRIBUTION COMPARED TO MALWARE
708.05.2017
Malware vs. PUA
10 million unique
Files/Month
Windows, Linux,
Android and Mac 0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Malware PUA
AV Future Challenge: PUA
“IN THE WILD” PUA VS BENIGN APPS, WINDOWS
808.05.2017
Benign vs. PUA
14.000 unique
Installer/Month
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
PUA Benign
AV Future Challenge: PUA
“IN THE WILD” PUA VS BENIGN APPS, ANDROID
908.05.2017
Benign vs. PUA
including Malware
20.000 unique
APKs/Month
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Benign Malware PUA
AV Future Challenge: PUA
PERMISSION REQUESTS ON ANDROID
1108.05.2017
1.000 Malware,
600 PUA and
600 Benign
unique samples 163
265
324
119,12
55,71
14,38
0
50
100
150
200
250
300
350
Malware PUA Benign
Sum of unique permission requests Average permissions requested per App
AV Future Challenge: PUA
July 2016
PERMISSION REQUESTS ON ANDROID
1208.05.2017
1.000 Malware,
600 PUA and
600 Benign
unique samples
AV Future Challenge: PUA
July 2016
7,8424,16 17,54
396
270
161
0
50
100
150
200
250
300
350
400
450
Benign PUA Malware
Average permission requested per App Sum unique permission requests
0,00%
5,00%
10,00%
15,00%
20,00%
25,00%
30,00%
35,00%
40,00%
45,00%
50,00%
Malware PUA Benign
Signature (SystemOrSignature) No classification Dangerous Normal Unknown
CLASSIFICATION OF REQUESTED PERMISSIONS
1308.05.2017
Permission
classification
provided by
Google and
Permissions set in
Manifest
AV Future Challenge: PUA
July 2016
0,00%
10,00%
20,00%
30,00%
40,00%
50,00%
60,00%
Benign PUA Malware
signatureOrSystem None Dangerous Normal Signature None Provided -
CLASSIFICATION OF REQUESTED PERMISSIONS
1408.05.2017
Permission
classification
provided by
Google and
Permissions set in
Manifest
AV Future Challenge: PUA
July 2016
CLASSIFICATION OF REQUESTED PERMISSIONS CONT.
1508.05.2017 AV Future Challenge: PUA
0,00%
1,00%
2,00%
3,00%
4,00%
5,00%
6,00%
Malware PUA Benign
Malware PUA BenignMalware
PUA
Benign
PUAType
- D D D D D D - Non S - Nor D DNorNorNorNorClassification
July 2016
DATA TRANSMITTED, ANDROID AND WINDOWS
1608.05.2017 AV Future Challenge: PUA
Benign PUA
IMEI (International Mobile Station Equipment Identity)
0,00% 27,56%
Device id (unique device identifier) 0,00% 2,95%
Root (device rooted or not) 0,00% 3,64%
Agent (user agent of browser) 0,16% 3,29%
IP Dest (IP destination) 0,32% 2,25%
Mac (unique network adapter address) 2,23% 10,57%
Device Model 9,38% 28,25%
OS Version 7,00% 15,42%
Android
Windows Benign PUA Malware
Relevant transmitted PUA data
Computer name 0,10% 7,36% 0,14%
Country 0,66% 8,23% 0,07%
City 0,00% 1,25% 0,00%
Relevant transmitted malware data
Browser details 0,05% 1,25% 13,16%
Region 0,00% 1,37% 4,46%
July 2016
DESTINATION OF DATA TRANSMITTED, ANDROID
1708.05.2017
2%
48%
10%6%
2%
18%
14%
Benign Traffic Destination
China
United States
Germany
Netherlands
Russian Federation
Other Europe
Other
52%
25%
7%
4%2%
4%6%
PUA Traffic Destination
China
United States
Germany
Netherlands
Russian Federation
Other Europe
Other
AV Future Challenge: PUA
July 2016
77%
5%
1%1%
2%2%3%
4%5%
Benign Traffic Destination
United States
Germany
Netherlands
China
France
United Kingdom
Russian Federation
Other Europe
DESTINATION OF DATA TRANSMITTED, WINDOWS
1808.05.2017
68%
8%
6%
4%4%
2%1%4% 3%
PUA Traffic Destination
United States
Germany
Netherlands
China
France
United Kingdom
Russian Federation
Other Europe
50%
3%6%
17%
3%2%
5%6% 8%
Malware Traffic Destination
United States
Germany
Netherlands
China
France
United Kingdom
Russian Federation
Other Europe
AV Future Challenge: PUA
July 2016
THREAT TO PRIVACY AND BUSINESS SECURITY
1908.05.2017 AV Future Challenge: PUA
Protection against malware and infections
Providing additional Security features like reputation of files and
webpages, secure banking, file vaults, parental control etc.
Provide a hassle free usage of device by not slowing the computer
and being mostly invisible
Protect Privacy
…
And provide protection against disruptive software
AV AND PUA
Where AVs fit in
2008.05.2017 AV Future Challenge: PUA
PUA DETECTION
2108.05.2017
July/August 2016
AV Future Challenge: PUA
Windows Android
PUA detection choice during Setup 03/35 1/22
In-App Option change PUA Settings (activated by default)
17/35 05/22
In-App Option change PUA Settings (deactivated by default)
04/35 04/22
PUA detection present but no option to change settings
08/35 10/22
No Option to detect PUA, low detection rate
03/35 02/22
Malware Average detection rate 98,18% 99,63%
PUA Average detection rate 87,31% 93,98%
PUA VS MALWARE DETECTION RATE, WINDOWS
PUA vs. Malware
detection rate per
product
(on-demand)
2208.05.2017
August 2016
AV Future Challenge: PUA
0,00%
10,00%
20,00%
30,00%
40,00%
50,00%
60,00%
70,00%
80,00%
90,00%
100,00%
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
PUA detection Malware detection
PUA =87.31%
Malware =98.18%
PUA VS MALWARE DETECTION RATE, ANDROID
PUA vs. Malware
detection rate per
product
2308.05.2017 AV Future Challenge: PUA
0,00%
10,00%
20,00%
30,00%
40,00%
50,00%
60,00%
70,00%
80,00%
90,00%
100,00%
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
PUA detection Malware detection
PUA =93.98%
Malware =99.63%
July 2016
CONCLUSION
AV Future Challenge: PUA
PUA is a problem as prevalent as Malware, maybe more…
Users are more likely to ‘see’ PUA instead of Malware.
More private data saved on digital/mobile devices.
Data is targeted by everyone, governments, vendors, distributers.
Users expect AV to protect or at least warn them.
Even more focus must be put on protecting data on devices
08.05.2017 24