Eight Years of Rider Measurement in the Android Malware Ecosystem

Abstract

Despite the growing threat posed by Android malware, the research community is still lacking a comprehensive view of common behaviors and trends exposed by malware families active on the platform. Without such view, the researchers incur the risk of developing systems that only detect outdated threats, missing the most recent ones. In this paper, we conduct the largest measurement of Android malware behavior to date, analyzing over 1.2 million malware samples that belong to 1.2K families over a period of eight years (from 2010 to 2017). We aim at understanding how the behavior of Android malware has evolved over time, focusing on repackaging malware. In this type of threats different innocuous apps are piggybacked with a malicious payload (rider), allowing inexpensive malware manufacturing.One of the main challenges posed when studying repackaged malware is slicing the app to split benign components apart from the malicious ones. To address this problem, we use differential analysis to isolate software components that are irrelevant to the campaign and study the behavior of malicious riders alone. Our analysis framework relies on collective repositories and recent advances on the systematization of intelligence extracted from multiple anti-virus vendors. We find that since its infancy in 2010, the Android malware ecosystem has changed significantly, both in the type of malicious activity performed by the malicious samples and in the level of obfuscation used by malware to avoid detection. We then show that our framework can aid analysts who attempt to study unknown malware families. Finally, we discuss what our findings mean for Android malware detection research, highlighting areas that need further attention by the research community.

Anomaly‐based exploratory analysis and detection of exploits in android mediaserver

“…As pointed out in [7], a number of critical vulnerabilities have been reported for Android platforms 3 . Particularly, the Android mediaserver has been repeatedly targeted recently through the Stagefright media playback engine.…”

MadDroid: Characterizing and Detecting Devious Ad Contents for Android Apps

“…Specifically, we rely on anti-virus scanners to flag malicious artifact. Concretely, DDM sends these non-image artifacts to VirusTotal [11], a free online service that integrates over 60 anti-virus engines, has been widely adopted by the research community [17,35,36,69]. Our prototype plugins implement detection schemes where, for each artifact that is sent to VirusTotal will be considered as ad devious content whenever at least three (3) anti-virus scanners flag it as suspicious.…”

Ransomware Detection System for Android Applications

“…Also, reflection is a popular java feature in Android as it allows to get information about classes and components while an app is running and modify them. The reflection API java.lang.reflect includes classes and interfaces that can be used to dynamically load code at runtime [67]. The package java.lang.reflect was called in all benign apps except one.…”

“…This package includes features to keep track of phone data such as network type and connection state. Also, it can be indicative of evasion [67,70]. Figure 11 shows an example screenshots of one ransomware app (MD5: 77ADB4D5A4F8AF9B8A6D23676848C6) handling many function calls from this package.…”