A Large Scale Investigation of Obfuscation Use in Google Play

Wermke, Dominik; Huaman, Nicolas; Acar, Yasemin; Reaves, Brad; Traynor, Patrick; Fahl, Sascha

doi:10.48550/arxiv.1801.02742

Cited by 1 publication

(4 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We also find that the use of obfuscation techniques dramatically increased since the early days of Android malware, with specimens nowadays pervasively using native code and including external scripts to avoid easy analysis. This contrasts with the amount of legitimate apps that are currently obfuscated-a recent investigation shows that less than 25% of apps in Google Play are obfuscated [47], while we show that over 90% of the riders have the ability to use advanced obfuscation techniques. A consequence of this is that antimalware systems trained on carriers and/or older datasets might not be effective in detecting the most recent threats, especially when they only rely on static analysis.…”

Section: Introductioncontrasting

confidence: 81%

“…We show that all forms of obfuscation are increasingly more popular in malware, with the usage of cryptography present in 90% of the families in 2017. When putting this in perspective with respect to legitimate apps [47], we show sharp increase in the use these techniques. Discussions about the attribution of certain behaviors such as the use of obfuscation to repackaged malware have been recurrent in literature over the last few years [29].…”

Section: B Key Findingsmentioning

confidence: 95%

“…Evidence of obfuscation: A large scale investigation of the use of obfuscation in Google Play have recently shown that only 24.9% of the apps are obfuscated [47]. In this work we look at certain evidences of obfuscation among riders.…”

Section: B Key Findingsmentioning

confidence: 99%

“…Recent work studied the use of obfuscation on goodware on the Google Play store [47] Authors showed that less than 25% of apps have been obfuscated by the primary developer. Instead, we show that the obfuscation in malware is way more prominent.…”

Section: Evolution Over Timementioning

confidence: 99%

See 3 more Smart Citations

Eight Years of Rider Measurement in the Android Malware Ecosystem

Suárez-Tangil

Stringhini

2022

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Despite the growing threat posed by Android malware, the research community is still lacking a comprehensive view of common behaviors and trends exposed by malware families active on the platform. Without such view, the researchers incur the risk of developing systems that only detect outdated threats, missing the most recent ones. In this paper, we conduct the largest measurement of Android malware behavior to date, analyzing over 1.2 million malware samples that belong to 1.2K families over a period of eight years (from 2010 to 2017). We aim at understanding how the behavior of Android malware has evolved over time, focusing on repackaging malware. In this type of threats different innocuous apps are piggybacked with a malicious payload (rider), allowing inexpensive malware manufacturing.One of the main challenges posed when studying repackaged malware is slicing the app to split benign components apart from the malicious ones. To address this problem, we use differential analysis to isolate software components that are irrelevant to the campaign and study the behavior of malicious riders alone. Our analysis framework relies on collective repositories and recent advances on the systematization of intelligence extracted from multiple anti-virus vendors. We find that since its infancy in 2010, the Android malware ecosystem has changed significantly, both in the type of malicious activity performed by the malicious samples and in the level of obfuscation used by malware to avoid detection. We then show that our framework can aid analysts who attempt to study unknown malware families. Finally, we discuss what our findings mean for Android malware detection research, highlighting areas that need further attention by the research community.

show abstract

Section: Introductioncontrasting

confidence: 81%

Section: B Key Findingsmentioning

confidence: 95%

Section: B Key Findingsmentioning

confidence: 99%

Section: Evolution Over Timementioning

confidence: 99%

See 2 more Smart Citations