Hack.lu edition 2012 A forensic analysis of Android Malware

More documents

Recommendations

Info

$\H1B%-12345X@PJL JOB “HackingPrinters”$

Distribution over days of weekDistribution over each day of the week for each marketMarket Mon Tue Wed Thu Fri Sat SunGoogle 14.58% 15.85% 16.67% 16.32% 16.23% 10.32% 10.04%Appchina 15.68% 14.35% 15.99% 18.03% 17.99% 8.24% 9.73%Slideme 13.67% 15.57% 15.15% 14.81% 16.66% 12.28% 11.86%Freewarelovers 14.42% 15.71% 15.88% 17.31% 14.30% 10.59% 11.80%Proandroid 15.23% 17.17% 16.98% 15.19% 15.15% 9.84% 10.44%torrents 15.76% 14.92% 15.53% 15.4% 15.30% 11.76% 11.49%genome 14.31% 24.72% 18.84% 16.45% 13.75% 5.48% 6.44%Reading: From all applications that were fetched from the Googlemarket, 7565 (14.58%) were packaged a monday.K. Allix, Q. Jerome (SnT) Hack.lu Hack.lu 2012-24-10 11 / 33
Distribution over hoursPercent876543218765432100 2 4 6 8 10 12 14 16 18 20 22 0 0 2 4 6 8 10 12 14 16 18 20 22GoogleAppchina0Percent11111010998877665544332211000 2 4 6 8 10 12 14 16 18 20 22 0GenomeDistribution of applications over hours for three marketsK. Allix, Q. Jerome (SnT) Hack.lu Hack.lu 2012-24-10 12 / 33
Page 1 and 2: Hack.lu edition 2012A forensic anal
Page 3 and 4: The Starting PointA dataset of Andr
Page 5 and 6: Crawling for apps. . . IIMarkets wa
Page 7 and 8: The Metadata Approach IAndroid Appl
Page 9 and 10: Timestamps160Total number of appsNu
Page 11: Timestamps: Fun Facts IIMalware Aut
Page 15 and 16: InterludeThe Question. . .We collec
Page 17 and 18: InterludeThe Question. . .We collec
Page 19 and 20: But then. . . What are those certif
Page 21 and 22: Who cares anyway?Developers don’t
Page 23 and 24: Further experimentsQuestionIs it po
Page 25 and 26: Graph 2NoteIf there is still malwar
Page 27 and 28: ResultsResultsWe isolated 6,186 app
Page 29 and 30: QuestionWe have what we are looking
Page 31 and 32: The best android programmer ever se
Page 33 and 34: The mystery of leaked certificateWa
Page 35 and 36: Open questionsWhy a ’normal’ de

Hack.lu edition 2012 A forensic analysis of Android Malware

Create successful ePaper yourself

Delete template?

Save as template?