Kharon dataset: Android malware under a...

18
Kharon dataset: Android malware under a microscope Nicolas Kiss Jean-François Lalande Mourad Leslous Valérie Viet Triem Tong The LASER Workshop 2016 Learning from Authoritative Security Experiment Results May 26th 2016 N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Transcript of Kharon dataset: Android malware under a...

Page 1: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

Kharon dataset:Android malware under a microscope

Nicolas Kiss Jean-François Lalande Mourad LeslousValérie Viet Triem Tong

The LASER Workshop 2016Learning from Authoritative Security Experiment Results

May 26th 2016

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 2: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

2 / 15

Lessons learned

Android malware findings

malware hide themselves from dynamicanalysistriggering malware is not obvious

Methodology:

manual reverse engineering of 7malwaremanual triggering (not obvious)execution and information flow capture

By Con-struct + replicant

community [CC BY-SA 3.0]

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 3: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

2 / 15

Lessons learned

Android malware findings

malware hide themselves from dynamicanalysistriggering malware is not obvious

Methodology:

manual reverse engineering of 7malwaremanual triggering (not obvious)execution and information flow capture

By Con-struct + replicant

community [CC BY-SA 3.0]

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 4: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

3 / 15

Why building such a dataset ?

Papers with Android malware experiments:

use extracts of reference datasets:The Genome project (stopped !) [Zhou et al. 12]Contagio mobile dataset [Mila Parkour]Hand crafted malicious apps (DroidBench [Artz et al. 14])Some Security Challenges’ apps

need to be significant:Tons of apps (e.g. 1.3 million for PhaLibs [Chen et al. 16])Some apps (e.g. 11 for TriggerScope [Fratantonio et al. 16])

A well documented dataset does not exist !Online services give poor information !

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 5: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

3 / 15

Why building such a dataset ?

Papers with Android malware experiments:

use extracts of reference datasets:The Genome project (stopped !) [Zhou et al. 12]Contagio mobile dataset [Mila Parkour]Hand crafted malicious apps (DroidBench [Artz et al. 14])Some Security Challenges’ apps

need to be significant:Tons of apps (e.g. 1.3 million for PhaLibs [Chen et al. 16])Some apps (e.g. 11 for TriggerScope [Fratantonio et al. 16])

A well documented dataset does not exist !Online services give poor information !

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 6: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

4 / 15

Analyzing malware

Main analysis methods are:

static analysis:⇒ try to recognize knowncharacteristics of malware in thecode/ressources of studied applications

dynamic analysis:⇒ try to execute the malware

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 7: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

4 / 15

Analyzing malware

Main analysis methods are:

static analysis:⇒ try to recognize knowncharacteristics of malware in thecode/ressources of studied applications

dynamic analysis:⇒ try to execute the malware

Countermeasures:reflection, obfuscation,

dynamic loading, encryption

Countermeasures:logic bomb, time

bomb, remote server

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 8: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

5 / 15

Methodology

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 9: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

6 / 15

A collection of malware totally reversed

Kharon dataset: 7 malware1:

http://kharon.gforge.inria.fr/dataset

DroidKungFu, BadNews (2011, 2013)WipeLocker (2014)MobiDash (2015)SaveMe, Cajino (2015)SimpleLocker (2014)

1Approved by Inria’s Operational Legal and Ethical Risk AssessmentCommittee: We warn the readers that these samples have to be used forresearch purpose only. We also advise to carefully check the SHA256 hashof the studied malware samples and to manipulate them in a sandboxedenvironment. In particular, the manipulation of these malware impose tofollow safety rules of your Institutional Review Boards.

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 10: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

7 / 15

Remote admin Tools

Install malicious apps:

Badnews: Obeys to a remote server + delays attackTriggering: Patch the bytecode + Build a fake server

DroidKungFu1 (well known): Delays attackTriggering: Modify ’start’ to 1 in sstimestamp.xml andreboot the device

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 11: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

8 / 15

Blocker / Eraser

Wipes of the SD card and block social apps:

WipeLocker: Delayed AttackTriggering: Launch the app and reboot the device

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 12: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

9 / 15

Adware

Displays adds after some days:MobiDash: Delayed AttackTriggering: Launch the application, reboot the device andmodify com.cardgame.durak_preferences.xml

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 13: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

10 / 15

Spyware

Steals contacts, sms, IMEI, . . .SaveMe: Verifies the Internet accessTriggering: Enable Internet access and lauch the app

Cajino: Obeys a Baidu remote serverTriggering: Simulate a server command with an Intent

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 14: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

11 / 15

Ransomware

Encrypts user’s files and asks for paying:

SimpleLockerWaits the reboot of the deviceTriggering: send a BOOT_COMPLETED intent

More details about SimpleLocker...

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 15: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

12 / 15

Example: SimpleLocker

The main malicious functions:

org.simplelocker.MainService.onCreate()org.simplelocker.MainService$4.run()org.simplelocker.TorSender.sendCheck(final Context context)org.simplelocker.FilesEncryptor.encrypt()org.simplelocker.AesCrypt.AesCrypt(final String s)

The encryption loop:

final AesCrypt aesCrypt = new AesCrypt("jndlasf074hr");

for (final String s : this.filesToEncrypt) {aesCrypt.encrypt(s, String.valueOf(s) + ".enc");new File(s).delete();

}

The System Flow Graph:

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

http://kharon.gforge.inria.fr/dataset/SimpLocker_sample_fd694cf5ca1dd4967ad6e8c67241114c.html
Page 16: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

13 / 15

Discussion

Let’s discuss :)

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 17: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

14 / 15

Dataset overview

Type Name Protection against dynamic Analysis→ Remediation

RAT BadnewsObeys to a remote server and delays the attack

→ Modify the apk→ Build a fake server

Ransomware SimpleLocker Waits the reboot of the device→ send a BOOT_COMPLETED intent

RAT DroidKungFu Delayed Attack→ Modify the value start to 1 in sstimestamp.xml

Adware MobiDashDelayed Attack

→ Launch the infected application, reboot the deviceand modify com.cardgame.durak_preferences.xml

Spyware SaveMe Verifies the Internet access→ Enable Internet access and launch the application

Eraser+LK WipeLocker Delayed Attack→ Press the icon launcher and reboot the device

Spyware Cajino Obeys to a remote server→ Simulate the remote server by sending an intent

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

Page 18: Kharon dataset: Android malware under a microscopekharon.gforge.inria.fr/documents/slides-laser16.pdf · of the studied malware samples and to manipulate them in a sandboxed environment.

15 / 15

Conclusion

You are know able to execute the maliciouscode in a real environment and conduct

precise experiments

Kharon dataset is online !

descriptions and code extractsmalicious method namesGraph representation:⇒ replay the malware !

http://kharon.gforge.inria.fr/dataset

N. Kiss & J.-F. Lalande & M. Leslous & V. Viet Triem Tong Kharon dataset: Android malware under a microscope

http://kharon.gforge.inria.fr/dataset

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Kharon dataset: Android malware under a microscope

Kharon dataset: Android malware under a microscope

Real world sandboxed solutions

Real world sandboxed solutions

Mobile Security 2012mews.sv.cmu.edu/teaching/14829/f13/files/14829f13_15.pdf · •Sandboxed applications (same as OSX) – Protects OS from malware and certain malicious apps •Code

Mobile Security 2012mews.sv.cmu.edu/teaching/14829/f13/files/14829f13_15.pdf · •Sandboxed applications (same as OSX) – Protects OS from malware and certain malicious apps •Code

LinqToSharePoint SandBoxed Solution Shakir Majeed Khan

LinqToSharePoint SandBoxed Solution Shakir Majeed Khan

Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”.

Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”.

Android Malware Exposed-Evolution of Android Malware

Android Malware Exposed-Evolution of Android Malware

SharePoint Sandboxed Solutions and InfoPath - TechEd Middle East

SharePoint Sandboxed Solutions and InfoPath - TechEd Middle East

Best practices with SharePoint 2010 sandboxed solutions

Best practices with SharePoint 2010 sandboxed solutions

Sandboxed Solutions: maatwerk in SharePointbiplatform.nl/magazines/Aveq/116607.pdf · Sandboxed Solutions: maatwerk in SharePoint JUIST SHAREPOINT-BEHEERDERS PROFITEREN HIERVAN Robert

Sandboxed Solutions: maatwerk in SharePointbiplatform.nl/magazines/Aveq/116607.pdf · Sandboxed Solutions: maatwerk in SharePoint JUIST SHAREPOINT-BEHEERDERS PROFITEREN HIERVAN Robert

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

PhishEye: Xiao Han Live Monitoring of Sandboxed Phishing Kitss3.eurecom.fr/slides/ccs16_phisheye.slides.pdf · Live Monitoring of Sandboxed Phishing Kits Xiao Han Nizar Kheir Davide

PhishEye: Xiao Han Live Monitoring of Sandboxed Phishing Kitss3.eurecom.fr/slides/ccs16_phisheye.slides.pdf · Live Monitoring of Sandboxed Phishing Kits Xiao Han Nizar Kheir Davide

4 tools, sandboxed solutionds, web part development

4 tools, sandboxed solutionds, web part development

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Performing Sandboxed Testing with PlateSpin Forge

Performing Sandboxed Testing with PlateSpin Forge

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

Kharon : Découvrir, comprendre et reconnaître des malware ... file2/15 Sécurité des tablettes et smarphones Android Une application populaire, c’est 50 000 000 à 100 000 000

Kharon : Découvrir, comprendre et reconnaître des malware ... file2/15 Sécurité des tablettes et smarphones Android Une application populaire, c’est 50 000 000 à 100 000 000

Kharon dataset: Android malware under a microscope · Kharon dataset: Android malware under a microscope ... 1 Introduction Android malware have become a very active research ...

Kharon dataset: Android malware under a microscope · Kharon dataset: Android malware under a microscope ... 1 Introduction Android malware have become a very active research ...