Abstract:Application repackaging is a severe threat to Android users and the market. Not only does it infringe on intellectual property, but it is also one of the most common ways of propagating mobile malware. Existing countermeasures mostly detect repackaging based on app similarity measurement, which tends to be imprecise when obfuscations are applied to repackaged apps. Moreover, they rely on a central party, typically the hosting app store, to perform the detection, but many app stores fail to commit proper effort to piracy detection. We consider building the application repackaging detection capability into apps, such that user devices are made use to detect repackaging in a decentralized fashion. The main challenge is how to protect the detection code from being manipulated by attacks. We propose a creative use of logic bombs, which are otherwise regularly used in malware. The trigger conditions of bombs are constructed to exploit the differences between the attacker and users, such that a bomb that lies dormant on the attacker side will be activated on the user side. The detection code, which is part of the bomb payload, is executed only if the bomb is activated. We introduce cryptographically obfuscated logic bomb to enhance the bomb: (1) the detection code is woven into the neighboring original app code, (2) the mixed code gets encrypted using a key, and (3) the key is deleted from the app and can only be derived when the bomb is activated. Thus, attacks that try to modify or delete the detection code will corrupt the app itself, and searching the key in the application will be in vain. Moreover, we propose a bomb spraying technique that allows many bombs to be injected into an app, multiplying the needed adversary effort for bypassing the detection. In addition to repackaging detection, we present application tampering detection to fight attacks -hat insert malicious code into repackaged apps. We have implemented a prototype, named BombDroid, that builds repackaging and tampering detection into apps through bytecode instrumentation. The evaluation and the security analysis show that the technique is effective, efficient, and resilient to various bomb analysis techniques including fuzzing, symbolic execution, multi-path exploration, and program slicing. Ethical issues due to the use of logic bombs are also discussed.

Detection of App Collusion Potential Using Logic Programming

AppHolmes: Detecting and Characterizing App Collusion among Third-Party Android Markets.

Detecting Malicious Collusion Between Mobile Software Applications: The Android TM Case

An Improved Android Collusion Attack Detection Method Based on Program Slicing.

Fast, Scalable Detection of "piggybacked" Mobile Applications

Hybrid User-level Sandboxing of Third-party Android Apps.

Towards Mining Comprehensive Android Sandboxes.

Detecting Passive Content Leaks and Pollution in Android Applications.

Android Inter-App Communication Threats, Solutions, and Challenges

Malware Collusion Attack Against Machine Learning Based Methods: Issues and Countermeasures

Malware Collusion Attack Against SVM: Issues and Countermeasures

Resilient User-Side Android Application Repackaging and Tampering Detection Using Cryptographically Obfuscated Logic Bombs

Improving Logic Bomb Identification in Android Apps via Context-Aware Anomaly Detection

RepDroid: An Automated Tool for Android Application Repackaging Detection

TriggerZoo: A Dataset of Android Applications Automatically Infected with Logic Bombs

On The (In)Effectiveness of Static Logic Bomb Detector for Android Apps

Checking Interaction-Based Declassification Policies for Android Using Symbolic Execution

AnaDroid: Malware Analysis of Android with User-supplied Predicates

A Lightweight Dynamic Enforcement of Privacy Protection for Android

SecComp: Towards Practically Defending Against Component Hijacking in Android Applications

AppsPlayground: automatic security analysis of smartphone applications.