Quintans • Strazzere Information Technology / Security & Auditing Dunham • Hartman Morales The rapid growth and development of Android-based devices has resulted in a ANDROID MALWARE wealth of sensitive information on mobile devices that offer minimal malware protection. This has created an immediate demand for security professionals that understand how to best approach the subject of Android malware threats AND ANALYSIS and analysis. ANDROID MALWARE AND ANALYSIS ANDROID MALWARE In Android Malware and Analysis, Ken Dunham, renowned global malware expert and author, teams up with international experts to document the best tools and tactics available for analyzing Android malware. The book covers both methods of malware analysis: dynamic and static. This tactical and practical book shows you how to use to use dynamic malware analysis to check the behavior of an application/malware as it has been executed in the system. It also describes how you can apply static analysis to break apart the application/malware using reverse engineering tools and techniques to recreate the actual code and algorithms used. The book presents the insights of experts in the field, who have already sized up the best tools, tactics, and procedures for recognizing and analyzing Android malware threats quickly and effectively. You also get access to an online library of tools that supplies what you will need to begin your own analysis of Android malware threats. Tools available on the book’s site include updated information, tutorials, code, scripts, and author assistance. This is not a book on Android OS, fuzzy testing, or social engineering. Instead, it is about the best ways to analyze and tear apart Android malware threats. After reading the book, you will be able to immediately implement the tools and tactics covered to identify and analyze the latest evolution of Android threats. K23862 6000 Broken Sound Parkway, NW Suite 300, Boca Raton, FL 33487 ISBN: 978-1-4822-5219-4 711 Third Avenue 90000 New York, NY 10017 Ken Dunham • Shane Hartman an informa business 2 Park Square, Milton Park www.crcpress.com Abingdon, Oxon OX14 4RN, UK Jose Andre Morales 9 781482 252194 www.auerbach-publications.com Manu Quintans • Tim Strazzere K23862 cvr mech.indd 1 9/18/14 1:23 PM ANDROID MALWARE AND ANALYSIS OTHER INFORMATION SECURITY BOOKS FROM AUERBACH Anonymous Communication Networks: PRAGMATIC Security Metrics: Applying Protecting Privacy on the Web Metametrics to Information Security Kun Peng W. Krag Brotby and Gary Hinson ISBN 978-1-4398-8157-6 ISBN 978-1-4398-8152-1 Conducting Network Penetration and Responsive Security: Be Ready to Be Secure Espionage in a Global Environment Meng-Chow Kang Bruce Middleton ISBN 978-1-4665-8430-3 ISBN 978-1-4822-0647-0 Securing Cloud and Mobility: A Practitioner’s Guide Cyberspace and Cybersecurity Ian Lim, E. Coleen Coolidge, Paul Hourani George Kostopoulos ISBN 978-1-4398-5055-8 ISBN 978-1-4665-0133-1 Security and Privacy in Smart Grids Developing and Securing the Cloud Edited by Yang Xiao Bhavani Thuraisingham ISBN 978-1-4398-7783-8 ISBN 978-1-4398-6291-9 Security for Service Oriented Architectures Ethical Hacking and Penetration Walter Williams Testing Guide ISBN 978-1-4665-8402-0 Rafay Baloch Security without Obscurity: ISBN 978-1-4822-3161-8 A Guide to Confidentiality, Guide to the De-Identification of Authentication, and Integrity Personal Health Information J.J. Stapleton Khaled El Emam ISBN 978-1-4665-9214-8 ISBN 978-1-4665-7906-4 The Complete Book of Data Anonymization: Industrial Espionage: Developing a From Planning to Implementation Counterespionage Program Balaji Raghunathan Daniel J. Benny ISBN 978-1-4398-7730-2 ISBN 978-1-4665-6814-3 The Frugal CISO: Using Innovation and Information Security Fundamentals, Smart Approaches to Maximize Second Edition Your Security Posture Thomas R. Peltier Kerry Ann Anderson ISBN 978-1-4822-2007-0 ISBN 978-1-4398-1062-0 The Practical Guide to HIPAA Privacy and Information Security Policy Development for Security Compliance, Second Edition Compliance: ISO/IEC 27001, NIST SP 800-53, Rebecca Herold and Kevin Beaver HIPAA Standard, PCI DSS V2.0, and AUP V5.0 ISBN 978-1-4398-5558-4 Barry L. Williams Secure Data Provenance and Inference ISBN 978-1-4665-8058-9 Control with Semantic Web Investigating Computer-Related Crime, Bhavani Thuraisingham, Tyrone Cadenhead, Second Edition Murat Kantarcioglu, and Vaibhav Khadilkar Peter Stephenson and Keith Gilbert ISBN 978-1-4665-6943-0 ISBN 978-0-8493-1973-0 Secure Development for Mobile Apps: Managing Risk and Security in Outsourcing How to Design and Code Secure Mobile IT Services: Onshore, Offshore and the Cloud Applications with PHP and JavaScript Frank Siepmann J. D. Glaser ISBN 978-1-4398-7909-2 ISBN 978-1-4822-0903-7 AUERBACH PUBLICATIONS www.auerbach-publications.com • To Order Call: 1-800-272-7737 • E-mail: [email protected] ANDROID MALWARE AND ANALYSIS Ken Dunham • Shane Hartman Jose Andre Morales Manu Quintans • Tim Strazzere CRC Press Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2015 by Taylor & Francis Group, LLC CRC Press is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S. Government works Version Date: 20140918 International Standard Book Number-13: 978-1-4822-5220-0 (eBook - PDF) This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmit- ted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers. For permission to photocopy or use material electronically from this work, please access www.copyright. com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged. Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe. Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the CRC Press Web site at http://www.crcpress.com Contents P REFACE xi ACKNOWLEDGMENTS xiii AUTHORS xv C ONVENTIONS xix C HA P TER 1 I NTRODUCTION TO THE A NDROID O P E R ATI N G SYSTEM AND TH R E AT S 1 Android Development Tools 2 Risky Apps 3 Looking Closer at Android Apps 5 C HA P TER 2 M ALWARE TH R E AT S, H OAXES, AND TAXONOMY 7 2010 7 FakePlayer 7 DroidSMS 8 FakeInst 8 TapSnake 8 SMSReplicator 9 Geinimi 9 2011 10 ADRD 10 Pjapps 11 BgServ 11 DroidDream 11 Walkinwat 12 zHash 13 DroidDreamLight 13 V VI CONTENTS Zsone 14 BaseBridge 14 DroidKungFu1 15 GGTracker 16 jSMSHider 16 Plankton 17 GoldDream 18 DroidKungFu2 18 GamblerSMS 19 HippoSMS 19 LoveTrap 19 Nickyspy 20 SndApps 20 Zitmo 21 DogWars 21 DroidKungFu3 22 GingerMaster 22 AnserverBot 23 DroidCoupon 23 Spitmo 24 JiFake 24 Batterydoctor 24 2012 25 AirPush 25 Boxer 25 Gappusin 26 Leadbolt 26 Adwo 26 Counterclank 27 SMSZombie 27 NotCompatible 27 Bmaster 27 LuckyCat 28 DrSheep 28 2013 28 GGSmart 28 Defender 29 Qadars 29 MisoSMS 29 FakeRun 30 TechnoReaper 30 BadNews 31 Obad 31 2014 32 DriveGenie 32 Torec 32 OldBoot 33 DroidPack 33 CONTENTS VII C HA P TER 3 O P EN S OURCE TOOLS 35 Locating and Downloading Android Packages 36 Vulnerability Research for Android OS 37 Antivirus Scans 37 Static Analysis 38 Linux File Command 38 Unzip the APK 38 Strings 39 Keytool Key and Certificate Management Utility 39 DexID 39 DARE 40 Dex2Jar 40 JD-GUI 41 JAD 41 A PKTool 41 AndroWarn 41 Dexter 42 VisualThreat 43 Sandbox Analysis 43 AndroTotal 45 APKScan 45 Mobile Malware Sandbox 45 Mobile Sandbox 45 Emulation Analysis 45 Eclipse 45 DroidBox 46 AppsPlayground 46 Native Analysis 46 Logcat 46 Traceview and Dmtracedump 46 Tcpdump 47 Reverse Engineering 47 Androguard 47 AndroidAuditTools 48 Smali/Baksmali 48 AndBug 48 Memory Analysis 48 LiME 49 Memfetch 49 Volatility for Android 49 Volatilitux 49 C HA P TER 4 STATI C A N A LYS I S 51 Collections: Where to Find Apps for Analysis 52 Google Play Marketplace 52 Marketplace Mirrors and Cache 53 Contagio Mobile 53 VIII CONTENTS Advanced Internet Queries 53 Private Groups and Rampart Research Inc. 53 Android Malware Genome Project 54 File Data 54 Cryptographic Hash Types and Queries 55 Other Metadata 56 Antivirus Scans and Aliases 57 Unzipping an APK 57 Common Elements of an Unpacked APK File 57 Certificate Information 58 Permissions 59 Strings 60 Other Content of Interest within an APK 61 Creating a JAR File 62 VisualThreat Modeling 62 Automation 62 (Fictional) Case Study 63 C HA P TER 5 A NDROID M ALWARE EVOLUTION 71 C HA P TER