Design and Analysis of Push Notification-Based Malware on Android

Abstract

Establishing secret command and control (C&C) channels from attackers is important in malware design. This paper presents design and analysis of malware architecture exploiting push notification services as C&C channels. The key feature of the push notification-based malware design is remote triggering, which allows attackers to trigger and execute their malware by push notifications. The use of push notification services as covert channels makes it difficult to distinguish this type of malware from other normal applications also using the same services. We implemented a backdoor prototype on Android devices as a proofof-concept of the push notification-based malware and evaluated its stealthiness and feasibility. Our malware implementation effectively evaded the existing malware analysis tools such as 55 antimalware scanners from VirusTotal and SandDroid. In addition, our backdoor implementation successfully cracked about 98% of all the tested unlock secrets (either PINs or unlock patterns) in 5 seconds with only a fraction (less than 0.01%) of the total power consumption of the device. Finally, we proposed several defense strategies to mitigate push notification-based malware by carefully analyzing its attack process. Our defense strategies include filtering subscription requests for push notifications from suspicious applications, providing centralized management and access control of registration tokens of applications, detecting malicious push messages by analyzing message contents and characteristic patterns demonstrated by malicious push messages, and detecting malware by analyzing the behaviors of applications after receiving push messages.

Identifying Major Research Areas and Minor Research Themes of Android Malware Analysis and Detection Field Using LSA

“…Limited efforts are made to curtail remote triggering. It enhances the stealthiness of malware by allowing malware authors to trigger and execute malware whenever they want [147]. (d) Development of nonintuitive features for robust malware analysis and detection: static and dynamic features need to be explored to the next level to characterize the behavior of an application [146] better.…”

Earthquake Information Push Notification System in Android Application Using Google Firebase

“…This research also proposed several defense strategies against push notificationbased malware by carefully analyzing its attack process. [12] There is also research on the notification system for students using the Android application. Research is aimed at making communication between teacher and student easier and faster through this notification feature.…”

Using Push Notification in Telehealth and Remote Patient Monitoring Systems

“…In contrast, in push notifications, the updates are delivered from a server application to a device without a specific request from the client which has typically subscribed to updates in advance. In the case of smartphones, the client may be built into the operating system [14].…”