Hack.lu edition 2012 A forensic analysis of Android Malware

More documents

Recommendations

Info

$\H1B%-12345X@PJL JOB “HackingPrinters”$

Crawling for apps. . . IIIWhat we collectedTable: Number of Apps for each marketMarket name App NumberGoogle 51,885AppChina 63,476Slideme 15,409FreewareLovers 4,119ProAndroid 2,633Torrents 5,255Genome 1,258total 144,035total (dedup) 137,105K. Allix, Q. Jerome (SnT) Hack.lu Hack.lu 2012-24-10 5 / 33
The Metadata Approach IAndroid ApplicationsDistributed as Single-file .apk PackagesJust a zip file that contains:Compiled Code (Dalvik Bytecode)A Manifest fileResources (images, sounds, . . . )One Certificate (or more than one)A signature file→ Apps travel unmodified from Authors’ computer to users’smartphones. No tinkering done by MarketsK. Allix, Q. Jerome (SnT) Hack.lu Hack.lu 2012-24-10 6 / 33
Page 1 and 2: Hack.lu edition 2012A forensic anal
Page 3 and 4: The Starting PointA dataset of Andr
Page 5: Crawling for apps. . . IIMarkets wa
Page 9 and 10: Timestamps160Total number of appsNu
Page 11 and 12: Timestamps: Fun Facts IIMalware Aut
Page 13 and 14: Distribution over hoursPercent87654
Page 15 and 16: InterludeThe Question. . .We collec
Page 17 and 18: InterludeThe Question. . .We collec
Page 19 and 20: But then. . . What are those certif
Page 21 and 22: Who cares anyway?Developers don’t
Page 23 and 24: Further experimentsQuestionIs it po
Page 25 and 26: Graph 2NoteIf there is still malwar
Page 27 and 28: ResultsResultsWe isolated 6,186 app
Page 29 and 30: QuestionWe have what we are looking
Page 31 and 32: The best android programmer ever se
Page 33 and 34: The mystery of leaked certificateWa
Page 35 and 36: Open questionsWhy a ’normal’ de

Hack.lu edition 2012 A forensic analysis of Android Malware

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?