Hack.lu edition 2012 A forensic analysis of Android Malware

More documents

Recommendations

Info

$\H1B%-12345X@PJL JOB “HackingPrinters”$

Timestamps: Fun Facts IMalware come in batchesThe 1258 known Malware were packaged on only 244 differentdays, while they cover ∼ 3 yearsRecord day: 2011-09-21 (51 malware, nearly 25% of all apps thatday)Only 72 malware (5.7%) were packaged a day when no othermalware was packaged.K. Allix, Q. Jerome (SnT) Hack.lu Hack.lu 2012-24-10 9 / 33
Timestamps: Fun Facts IIMalware Authors can do much betterWe counted 78 cases where at least two malware were packagedin the same secondAt 15 instances, four or more malware were packaged in the samesecondTwo of those instances saw ten or more new malware beingpackaged.This strong time locality suggests that malware writers have set uptools to automate the malware packaging processK. Allix, Q. Jerome (SnT) Hack.lu Hack.lu 2012-24-10 10 / 33
Page 1 and 2: Hack.lu edition 2012A forensic anal
Page 3 and 4: The Starting PointA dataset of Andr
Page 5 and 6: Crawling for apps. . . IIMarkets wa
Page 7 and 8: The Metadata Approach IAndroid Appl
Page 9: Timestamps160Total number of appsNu
Page 13 and 14: Distribution over hoursPercent87654
Page 15 and 16: InterludeThe Question. . .We collec
Page 17 and 18: InterludeThe Question. . .We collec
Page 19 and 20: But then. . . What are those certif
Page 21 and 22: Who cares anyway?Developers don’t
Page 23 and 24: Further experimentsQuestionIs it po
Page 25 and 26: Graph 2NoteIf there is still malwar
Page 27 and 28: ResultsResultsWe isolated 6,186 app
Page 29 and 30: QuestionWe have what we are looking
Page 31 and 32: The best android programmer ever se
Page 33 and 34: The mystery of leaked certificateWa
Page 35 and 36: Open questionsWhy a ’normal’ de

Hack.lu edition 2012 A forensic analysis of Android Malware

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?