syssec_red_book

8. Security of Mobile Devicesinformation through native methods and IPC, TaintDroid patches JNI callbridges and the Binder IPC library. TaintDroid is effective, as it allows taintingto propagate between many different levels, and efficient, as it does so with avery low overhead. Unfortunately, this comes at the expense of low resiliencyand transparency: modifying internal Android components inevitably exposesTaintDroid to a series of detection and evasion techniques [121, 341, 355].DroidBox is a dynamic in-the-box Android malware analyzer [372] thatuses the custom instrumentation of the Android system and kernel to track asample’s behavior, relying on TaintDroid to perform taint tracking of sensitiveinformation [167]. Building on TaintDroid and instrumenting Android’s internalcomponents makes DroidBox prone to the problems of in-the-box analyses:malware can detect and evade the analyses or, worse, even disable them.Andrubis [7] is an extension to the Anubis dynamic malware analysissystem to analyze Android malware [99, 220]. According to its web site, it ismainly built on top of both TaintDroid [167] and DroidBox [372] and it thusshares their weaknesses (mainly due to operating “in-the-box”).CopperDroid performs automatic out-of-the-box dynamic behavioral analysisof Android malware [11, 331]. To this end, CopperDroid presents a unifiedsystem call-centric analysis to characterize low-level OS-specific and high-levelAndroid-specific behaviors, including IPC and RPC interactions—of paramountimportance on Android. Based on the observation that such behaviors are alleventually achieved through the invocation of system calls, CopperDroid’sVM-based dynamic system call-centric analysis is able to faithfully describethe behavior of Android malware whether it is initiated from Java, JNI ornative code execution. Based on the observation that Android applications areinherently user-driven and feature a number of implicit but well-defined entrypoints, CopperDroid furthermore describes the design and implementationof a stimulation approach aimed at disclosing additional malware behaviors.The authors carried out an extensive evaluation of the system to assess itseffectiveness on three different Android malware data sets: one of more than1,200 samples belonging to 49 Android malware families (Android MalwareGenome Project); one containing about 400 samples over 13 families (Contagioproject); and a final one, previously unanalyzed, comprising more than 1,300samples, provided by McAfee. Their experiments show that CopperDroid’sunified system call-based analysis faithfully describes OS- and Android-specificbehaviors, while a proper malware stimulation strategy (e.g., sending SMS,placing calls) successfully discloses additional behaviors in a non-negligibleportion of the analyzed malware samples.Google Bouncer [260], as its name suggests, is a service that “bounces”malicious applications off from the official Google Play (market). Little isknown about it, except that it is a QEMU-based dynamic analysis framework.62