Mascara: A Novel Attack Leveraging Android Virtualization Marco Alecci Riccardo Cestaro Mauro Conti Department of Information Engineering Department of Mathematics Department of Mathematics University of Padua University of Padua University of Padua Padua, Italy Padua, Italy Padua, Italy
[email protected] [email protected] [email protected] Ketan Kanishka Eleonora Losiouk Department of Computer Science and Engineering Department of Mathematics Indian Institute of Technology (BHU) University of Padua Varanasi, India Padua, Italy
[email protected] [email protected] Abstract—Android virtualization enables an app to create a efforts, malware developers still manage to overcome such virtual environment, in which other apps can run. Originally detection mechanisms, as it is confirmed by the 870,617 designed to overcome the limitations of mobile apps dimensions, malicious installation packages found in 2019 according to malicious developers soon started exploiting this technique to design novel attacks. As a consequence, researchers proposed this Kaspersky Lab analysis [4]. new defence mechanisms that enable apps to detect whether they Among the different approaches used to design a malware, are running in a virtual environment. attackers have recently started exploiting the virtualization In this paper, we propose Mascara, the first attack that exploits technique. When used in the Android Operating System (OS), the virtualization technique in a new way, achieving the full fea- this technique gives the opportunity to an app (i.e., Container sibility against any Android app and proving the ineffectiveness of existing countermeasures. Mascara is executed by a malicious App) to define a new environment, separate from the Android app, that looks like the add-on of the victim app.