Abstract:Today digital technologies are evolving to accommodate small businesses and young entrepreneurs by reducing their time-to-market while encouraging rapid innovation in mobile, Extended Reality (XR), Internet of Things (IoT), cloud, and edge devices. The leading operating system Android typically takes one to a few days to perform application vetting and go to production by leveraging code analysis technologies in their Play Protect anti-malware program. However, developers with malicious intent are looking to circumvent this detection mechanism by exploiting Google’s relatively lenient trust policies that allow for package distribution and feature updates. This paper develops a proof-of-concept malware that exploits customers’ trust and Google’s policies to circumvent popular voice search applications. Our results show that attackers can initially circumvent Play Protect by uploading benign applications to build trust and then add malicious feature updates incrementally to distribute highly intrusive malware into user systems. This malware can scan and collect private user data from the device and exfiltrate it to the command-and-control server. The contributions are three-fold. (1) A proof-of-concept stealthy malware and publishing mechanism has developed that highlights the relative ease with which Google Play Protect policies may be subverted. (2) a comprehensive evaluation has been performed using major publicly available anti-malware solutions. (3) Recommendations and policies have been suggested to prevent this attack and ensure users’ privacy concerns (IMUTA is a novel attack in which malicious functionality is slowly added to a benign application through updates. This attack evades malware detection tools and exploits user trust. The attack can be launched against any application distribution platform like the Play Store).

A Novel Attack against Android Phones

Dissecting Android Malware: Characterization and Evolution

AirBag: Boosting Smartphone Resistance to Malware Infection.

RiskRanker: scalable and accurate zero-day android malware detection.

Hey, You, Get off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets.

Systematic Detection of Capability Leaks in Stock Android Smartphones.

Detecting Passive Content Leaks and Pollution in Android Applications.

Circumventing Google Play vetting policies: a stealthy cyberattack that uses incremental updates to breach privacy

Sidewinder: Targeted attack against Android in the golden age of ad libraries

VenomAttack: Automated and Adaptive Activity Hijacking in Android

Reviving Android Malware with DroidRide: and How Not To.

Problem-Space Evasion Attacks in the Android OS: a Survey

Google Android: A State-of-the-Art Review of Security Mechanisms

DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware.

App in the Middle

Mascara: A Novel Attack Leveraging Android Virtualization

A Comprehensive Review of Android Security: Threats, Vulnerabilities, Malware Detection, and Analysis

Study on the Application of Dalvik Injection Technique for the Detection of Malicious Programs in Android

Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection

Ghost Installer in the Shadow: Security Analysis of App Installation on Android

Activityhijacker: Hijacking The Android Activity Component For Sensitive Data