Defining and Detecting Environment Discrimination in Android Apps Yunfeng Hong1, Yongjian Hu2, Chun-Ming Lai1, S. Felix Wu1, Iulian Neamtiu3, Patrick McDaniel4, Paul Yu5, Hasan Cam5, and Gail-Joon Ahn6 1 University of California, Davis yfhong, cmlai,
[email protected] 2 University of California, Riverside
[email protected] 3 New Jersey Institute of Technology
[email protected] 4 Pennsylvania State University
[email protected] 5 U.S. Army Research Laboratory fpaul.l.yu,
[email protected] 6 Arizona State University
[email protected] Abstract. Environment discrimination | a program behaving differ- ently on different platforms | is used in many contexts. For example, malware can use environment discrimination to thwart detection at- tempts: as malware detectors employ automated dynamic analysis while running the potentially malicious program in a virtualized environment, the malware author can make the program virtual environment-aware so the malware turns off the nefarious behavior when it is running in a virtualized environment. Therefore, an approach for detecting envi- ronment discrimination can help security researchers and practitioners better understand the behavior of, and consequently counter, malware. In this paper we formally define environment discrimination, and pro- pose an approach based on abstract traces and symbolic execution to detect discrimination in Android apps. Furthermore, our approach dis- covers what API calls expose the environment information to malware, which is a valuable reference for virtualization developers to improve their products. We also apply our approach to the real malware and third-party-researcher designed benchmark apps. The result shows that the algorithm and framework we proposed achieves 97% accuracy.