Abstract:Application repackaging is a severe threat to Android users and the market. Not only does it infringe on intellectual property, but it is also one of the most common ways of propagating mobile malware. Existing countermeasures mostly detect repackaging based on app similarity measurement, which tends to be imprecise when obfuscations are applied to repackaged apps. Moreover, they rely on a central party, typically the hosting app store, to perform the detection, but many app stores fail to commit proper effort to piracy detection. We consider building the application repackaging detection capability into apps, such that user devices are made use to detect repackaging in a decentralized fashion. The main challenge is how to protect the detection code from being manipulated by attacks. We propose a creative use of logic bombs, which are otherwise regularly used in malware. The trigger conditions of bombs are constructed to exploit the differences between the attacker and users, such that a bomb that lies dormant on the attacker side will be activated on the user side. The detection code, which is part of the bomb payload, is executed only if the bomb is activated. We introduce cryptographically obfuscated logic bomb to enhance the bomb: (1) the detection code is woven into the neighboring original app code, (2) the mixed code gets encrypted using a key, and (3) the key is deleted from the app and can only be derived when the bomb is activated. Thus, attacks that try to modify or delete the detection code will corrupt the app itself, and searching the key in the application will be in vain. Moreover, we propose a bomb spraying technique that allows many bombs to be injected into an app, multiplying the needed adversary effort for bypassing the detection. In addition to repackaging detection, we present application tampering detection to fight attacks -hat insert malicious code into repackaged apps. We have implemented a prototype, named BombDroid, that builds repackaging and tampering detection into apps through bytecode instrumentation. The evaluation and the security analysis show that the technique is effective, efficient, and resilient to various bomb analysis techniques including fuzzing, symbolic execution, multi-path exploration, and program slicing. Ethical issues due to the use of logic bombs are also discussed.

PMDET: Automated Detection Tool of Android Parcel Mismatch

Happer - Unpacking Android Apps via a Hardware-Assisted Approach.

Parema: an Unpacking Framework for Demystifying VM-based Android Packers.

PackerGrind: An Adaptive Unpacking System for Android Apps.

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

EXAMINER-PRO: Testing Arm Emulators Across Different Privileges

RepDroid: An Automated Tool for Android Application Repackaging Detection

Towards Privacy-Preserving Malware Detection Systems for Android

A Detection Method and System Implementation for Android Malware

Reviving Android Malware with DroidRide: and How Not To.

AmandaSystem: A new framework for static and dynamic Android malware analysis

What Did You Pack in My App? a Systematic Analysis of Commercial Android Packers.

Design of the Universal Unpacker for Malicious Code Detection on the Android Platform

AppSpear: Bytecode Decrypting and DEX Reassembling for Packed Android Malware

A Mitmproxy-based Dynamic Vulnerability Detection System for Android Applications

AppSpear: Automating the Hidden-Code Extraction and Reassembling of Packed Android Malware

Resilient User-Side Android Application Repackaging and Tampering Detection Using Cryptographically Obfuscated Logic Bombs

Embroidery: Patching Vulnerable Binary Code of Fragmentized Android Devices

AutoPatchDroid: A Framework for Patching Inter-App Vulnerabilities in Android Application

On the (in)security of Manufacturer-Provided Remote Attestation Frameworks in Android.

DroidMD: an Efficient and Scalable Android Malware Detection Approach at Source Code Level