Upload File

you don’t need av for android?? how modern multi stage android malware payload is succeeding to...

  • Home
  • Mobile
  • You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices
65
You don’t Need AV for Android?? How modern multi stage Android malware is succeeding to infect Android devices Jagadeesh Chandraiah Threat Researcher AVAR 2016

Upload: jagadeesh-chandraiah

Post on 15-Apr-2017

572 views

Category:

Mobile


0 download

Report

TRANSCRIPT

Page 1: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

You don’t Need AV for Android?? How modern multi stage Android malware is succeeding to infect

Android devices

Jagadeesh ChandraiahThreat Researcher

AVAR 2016

Page 2: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Who am I

2

• Threat Researcher at Sophos, UK

• Interested in Windows, Mobile Malware Analysis and Research

• Spoken at Deepsec, Virus Bulletin in the past

AVAR 2016

Page 3: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Agenda

3

• You don’t need AV for Android

• Android Security services

• Infection timeline

• Multi-Stage Android Malware

• Why we need AV on Android platform

AVAR 2016

Page 4: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

You Don’t Need Android AV !!

Page 5: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Mobile Antivirus is not needed - Google

5

https://nakedsecurity.sophos.com/2014/07/09/googles-android-security-chief-dont-bother-with-anti-virus-is-he-serious/

Page 6: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Security Software firms are Scammers

6

http://www.smh.com.au/technology/security/charlatans-and-scammers-googler-slams-security-software-firms-20111123-1ntpu.html

Page 7: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Android Security Services

Page 8: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Security Services

8AVAR 2016

https://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf

https://static.googleusercontent.com/media/source.android.com/en/security/reports/Google_Android_Security_2015_Report_Final.pdf
Page 9: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Security Services

9AVAR 2016

Page 10: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Scoring Engine

10AVAR 2016

https://static.googleusercontent.com/media/source.android.com/en//security/reports/Android_WhitePaper_Final_02092016.pdf

• Apps are classified on the scale of Safe to Harmful

• Harmful apps are sent for Human review

https://static.googleusercontent.com/media/source.android.com/en/security/reports/Android_WhitePaper_Final_02092016.pdf
Page 11: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Security Services

11AVAR 2016

https://static.googleusercontent.com/media/source.android.com/en//security/reports/Android_WhitePaper_Final_02092016.pdf

https://static.googleusercontent.com/media/source.android.com/en/security/reports/Android_WhitePaper_Final_02092016.pdf
Page 12: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Potentially Harmful Applications (PHA)

Page 13: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

PHA

13AVAR 2016

Page 14: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

14AVAR 2016

https://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf

PHA

https://static.googleusercontent.com/media/source.android.com/en/security/reports/Google_Android_Security_PHA_classifications.pdf
Page 15: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

15AVAR 2016

Page 16: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Android Fragmentation

Page 17: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Android Fragmentation

17

https://developer.android.com/about/dashboards/index.html , Data from 7 day period ending on Nov 7, 2016

AVAR 2016

GingerBread

Ice CreamSandwichJellyBean

KitKat

Lollipop

Marshmallow

Nougat

Gingerbread(2.3.x) 1.3%

Lollipop(5.x) 34.1%

KitKat(4.4) 25.2%

Jelly Bean (4.1-4.3) 13.7%

Marshmallow(6.0) 24.0%

Ice Cream Sandwich(4.0) 1.3%

Nougat(7.0) 0.3%

https://developer.android.com/about/dashboards/index.html
Page 18: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Android Fragmentation

18AVAR 2016

• Slow pace of adaptation of new Android versions

• Many users with outdated software with lots of security Vulnerabilities.

• Latest security fixes are not rolled out quickly

• Cannot force manufacturers to roll out security updates.

• Business model forces users to buy new phones than update.

Page 19: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Android Fragmentation? Fix

19AVAR 2016

• Google has started rolling out its own devices , PIXEL series.

• Updated some features and updates through Google play services

• Does Google look like solving Fragmentation ? Probably not

• Android is still very popular…

• Developers are writing more apps ….

Page 20: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Android Malware Infections

Page 21: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Android Malware Infections

21AVAR 2016

Page 22: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Google play Infections

22AVAR 2016

~10-12 malware occurrences in Google play store in 2015

Malware seen pretty much every month in 2016

Page 23: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Google play Infections

23AVAR 2016

- Brain Test2

- Turk Clicker

- Xiny

Jan 2016

Feb 2016

Porn Clickers (500k)

InstaAgent2

(100-500k)

Mar 2016

May 2016

-Viking Horde

(50-100k)

- Clicker

-Valeriy

-Level Dropper

(5k)

Jun 2016

Aug 2016

Dress Code1

-Call Jam

-Embassy Spyware

-Dresscode2 (100-500k)

Sep 2016

Nov 2016

Multiple Accounts (1-5Mil)

Many Apps with 100-500k Install

Count

Millions of devices infected

2016

Page 24: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Noteworthy Malware

Page 25: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Ghost Push

Page 26: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Ghost Push

26AVAR 2016

https://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf

Page 27: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Ghost Push

27AVAR 2016

https://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf

Page 28: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Ghost Push

28AVAR 2016

https://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf

3.5 Billion Installation Attempts

New variants spotted in Sep/Oct 2016

Page 29: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Ghost Push

29AVAR 2016

• Downloader which downloads other malware and aggressive adware.

• Also known as ‘Rootnik’ , ‘Shedun’ etc,

• An OTA company update infrastructure and Application Install service was causing several Ghost push installations

• Several variants of Ghost push were seen

• Highly Persistent

Page 30: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Ghost Push

30AVAR 2016

Page 31: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

31AVAR 2016

Ghost Push

Page 32: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Ghost Push

32AVAR 2016

Page 33: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Ghost Push

33AVAR 2016

Page 34: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Brain Test

Page 35: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Brain Test

35

• Employed Anti analysis

• Anti analysis like IP checking , Time Bomb and Dynamic Loading

• Persistence methods used to avoid uninstalling

• Appeared multiple times on Google play

AVAR 2016

Page 36: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Brain Test

36AVAR 2016

http://blog.checkpoint.com/2015/09/21/braintest-a-new-level-of-sophistication-in-mobile-malware/

Page 37: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Brain Test

37AVAR 2016

Check if hostname contains ‘google ‘or ‘android’

Check IP ranges for Google servers

216.58.192.0 - 216.58.223.255

209.85.128.0 - 209.85.255.255

Page 38: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Brain Test

38AVAR 2016

Persistence

Modification

Script

Page 39: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Many variants with similar execution model

39

• Viking Horde - Botnet

• Godless - Exploit kit, Downloader

• Xiny - Hides payload in Image, Downloader, Ad network

• Rooting exploits and Rooting services used

• Watchdog modules for persistence

• Ad revenue, Click Fraud, Botnets ..

AVAR 2016

Page 40: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Feabme

Page 41: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Feabme

41

• Popular Game on Google play -Up to 1 Million install count

• Had a working game with Phishing code

AVAR 2016

Page 42: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Feabme

42AVAR 2016

• Uses open source cross platform Dotnet framework

• Dll’s inside assemblies folder had malicious code

Page 43: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Feabme

43AVAR 2016

Page 44: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Feabme

44AVAR 2016

Page 45: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Feabme

45AVAR 2016

Page 46: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Feabme

46AVAR 2016

Page 47: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

InstaAgent

Page 48: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

InstaAgent

48AVAR 2016

• App found on both Google play and ios store

• Was very popular app with up to 100k install count

• Simple credential stealing app with big Impact

• Similar apps appeared multiple times

• Injects JS code into web page to steal data

Page 49: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

InstaAgent

49AVAR 2016

Page 50: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

InstaAgent

50AVAR 2016

http://peppersoft.net/hacking-the-hacker/

Page 51: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

InstaAgent

51AVAR 2016

Page 52: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Dress Code

Page 53: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Dress Code

53AVAR 2016

Page 54: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Dress Code

54

• Lots of Infected Apps found on Google Play

• Some of the apps were installed 100k-500k times

• About 400 Infected apps were found in Google play

• Malware appeared multiple times on Google play

• Creates botnet when user executes infected app.

• Traffic is rerouted to help attacker.

AVAR 2016

http://blog.trendmicro.com/trendlabs-security-intelligence/dresscode-potential-impact-enterprises/

Page 55: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Dress Code

55AVAR 2016

Page 56: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Dress Code

56AVAR 2016

Page 57: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Sophistication and Breaking Security Services

Page 58: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Increased Sophistication

58

• Leave the payload for later stage

• Pretend as Clean app

• Target Popular apps and Games

• Use Exploits, Rooting tools and services

AVAR 2016

Page 59: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Anti Analysis

59

• Detect analysis Environment

• Obfuscation

• Encrypt and Hide Payloads

• Dynamic/Runtime Code

• Detection Evasion using smaller simpler modules and tricks

AVAR 2016

Page 60: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Why do we need Security Software?

Page 61: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

So, how big is the malware risk ??

61

• Malware occurrences is still relatively low compared to Windows.

• Risk of infection is also low

AVAR 2016

Page 62: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Need for Security Software

62

• Google have done many Improvements but NOT ENOUGH !!

• Variants have appeared again and again on play store ( Dress Code, Brain Test, Insta care/Agent…)

• Popularity means more Risk !!

•Many threats on Google play found by AV/security firms

• Global AV community, security Researchers , Multiple Solutions

• Alert users about undetected Threats by Google

•Many AV apps are free and also provide extra security features

AVAR 2016

Page 63: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

Work Together

63

• Google can’t provide 100% security

• Can’t Detect all Threats like any other Security software

• Google should Join hands with AV community

• Share samples and information for better Eco System

AVAR 2016

AntivirusGoogle

Page 64: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

References/Further Read

64

• https://nakedsecurity.sophos.com/2014/07/09/googles-android-security-chief-dont-bother-with-anti-virus-is-he-serious/

• https://static.googleusercontent.com/media/source.android.com/en//security/reports/Android_WhitePaper_Final_02092016.pdf

• https://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf

• https://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf http://blog.checkpoint.com/2016/05/09/viking-horde-a-new-type-of-android-malware-on-google-play/

• http://blog.trendmicro.com/trendlabs-security-intelligence/godless-mobile-malware-uses-multiple-exploits-root-devices/

• http://news.drweb.com/show/?i=9803&lng=en&c=5

• http://blog.trustlook.com/2015/07/08/most-successful-malware-on-google-play/

• http://peppersoft.net/hacking-the-hacker/

• http://blog.checkpoint.com/2015/09/21/braintest-a-new-level-of-sophistication-in-mobile-malware/

• http://blog.trendmicro.com/trendlabs-security-intelligence/dresscode-potential-impact-enterprises/

AVAR 2016

https://nakedsecurity.sophos.com/2014/07/09/googles-android-security-chief-dont-bother-with-anti-virus-is-he-serious/
http://blog.checkpoint.com/2016/05/09/viking-horde-a-new-type-of-android-malware-on-google-play/
http://blog.checkpoint.com/2016/05/09/viking-horde-a-new-type-of-android-malware-on-google-play/
http://blog.checkpoint.com/2016/05/09/viking-horde-a-new-type-of-android-malware-on-google-play/
http://blog.trendmicro.com/trendlabs-security-intelligence/godless-mobile-malware-uses-multiple-exploits-root-devices/
http://news.drweb.com/show/?i=9803&lng=en&c=5
http://blog.trustlook.com/2015/07/08/most-successful-malware-on-google-play/
http://peppersoft.net/hacking-the-hacker/
http://blog.checkpoint.com/2015/09/21/braintest-a-new-level-of-sophistication-in-mobile-malware/
http://blog.trendmicro.com/trendlabs-security-intelligence/dresscode-potential-impact-enterprises/
Page 65: You don’t Need AV for Android?? How modern multi stage Android malware payload is succeeding to infect Android devices

@jag_chandra


Non-living entities Can infect organisms of every domain Commonly referred to by organism they infect Viruses that infect bacteria: Bacteriophage

Battle Infect

RC 7 Succeeding

Succeeding? Failing? Learning!

Clin Infect Dis

Succeeding with Agile

Succeeding on Facebook

Succeeding for generations - EY Family Business · 2013-09-23 · 2 Succeeding for generations Succeeding for generations 3 Family businesses contribute significantly to economies

Succeeding at succession

Succeeding with Technology Succeeding with Technology

Succeeding with eLearning

Guide Des Infect Ant

Dez Infect Are A

Acute Infect

Succeeding at Failure

Succeeding at Succeeding: Revolutions, Courts and the

Neuro Infect i i

Infect 0003

Succeeding with FOSS!

Succeeding in Reading

Succeeding at Interviews

Infect Ioas e

Succeeding with Metrics

TB hiv co infect

Every student succeeding

Emerging Infect Dis

Crimewareand Botnets · –Infect victim, mail copies to everyone in address book –Infect removable drives, e.g. USB keys –Infect shared network drives –Scan for vulnerable

Succeeding in College

BSL3 To Infect

Herpesviruses that Infect Fish

Succeeding With Consumers

Infect Disease

Single Moms Succeeding

Infect Iine Specific e

Succeeding with Scrum