安卓恶意软件对抗虚拟机检测：动态分析新挑战

需积分: 10 28 浏览量更新于2024-09-04 1 收藏 157KB PDF 举报

本文档《RageAgainsttheVirtualMachine》主要探讨了在Android恶意软件检测领域中，针对动态分析的逃避策略，尤其是在虚拟机环境中的反分析技术。作者们来自希腊的Foundation for Research and Technology-Hellas和美国哥伦比亚大学的研究团队，他们关注的重点在于如何识别和抵御恶意软件在Android模拟器中的动态分析。首先，研究者们指出，为了保护自己免受恶意软件的威胁，包括防病毒公司、移动应用市场以及安全研究社区在内的各方，广泛采用动态代码分析技术来检测和分析这类威胁。然而，恶意软件也开始利用各种手段来规避这些检测机制，特别是当它们运行在Android Emulator（模拟器）这样的虚拟环境中。文中提到的反分析技术被分为三个主要类别： 1. **静态属性分析**：恶意软件可能利用编译后的代码特征，如特定函数调用、异常行为或签名，来隐藏其真实意图。通过分析这些静态特性，检测系统试图确定程序的行为模式是否符合预期，从而判断其是否是真实的设备环境。 2. **动态传感器信息**：Android设备通常配备多种传感器（如GPS、摄像头等），恶意软件可能会尝试模仿真实设备对这些传感器的响应，以欺骗分析工具。通过监控并比较传感器数据的精确性和实时性，可以识别出模拟环境中的异常行为。 3. **VM相关复杂性**：针对Android Emulator特有的内部机制，恶意软件可能会利用模拟器的局限性，例如性能差异、API不完全支持等，设计策略来混淆或延迟分析。这可能涉及对特定API的非标准使用，或者故意制造错误以便检测工具无法正确解读。为了验证这些技术的有效性，研究者们将包含这些反分析策略的恶意软件样本实际应用到公开可用的Android动态分析系统中。实验结果令人担忧，表明现有的工具和服务在应对虚拟环境中恶意软件的逃避策略时存在漏洞，这突显了动态分析面临的挑战和需要不断进化的防护措施。《RageAgainsttheVirtualMachine》揭示了恶意软件在虚拟环境中的狡猾手段，并强调了动态分析领域的研究人员需要持续改进技术，以适应这些新的攻击方式。对于Android安全实践者和开发者来说，理解并应对这些反分析策略至关重要，以确保应用程序和用户的安全。

Rage Against the Virtual Machine:

Hindering Dynamic Analysis of Android Malware

Thanasis Petsas,

Giannis Voyatzis,

Elias Athanasopoulos,

Michalis Polychronakis,

†

Sotiris Ioannidis

Institute of Computer Science, Foundation for Research and Technology—Hellas, Greece

†

Columbia University, USA

{petsas, jvoyatz, elathan, sotiris}@ics.forth.gr, mikepo@cs.columbia.edu

ABSTRACT

Antivirus companies, mobile application marketplaces, and the se-

curity research community, employ techniques based on dynamic

code analysis to detect and analyze mobile malware. In this paper,

we present a broad range of anti-analysis techniques that malware

can employ to evade dynamic analysis in emulated Android envi-

ronments. Our detection heuristics span three different categories

based on (i) static properties, (ii) dynamic sensor information, and

(iii) VM-related intricacies of the Android Emulator. To assess the

effectiveness of our techniques, we incorporated them in real mal-

ware samples and submitted them to publicly available Android dy-

namic analysis systems, with alarming results. We found all tools

and services to be vulnerable to most of our evasion techniques.

Even trivial techniques, such as checking the value of the IMEI, are

enough to evade some of the existing dynamic analysis frameworks.

We propose possible countermeasures to improve the resistance of

current dynamic analysis tools against evasion attempts.

1. INTRODUCTION

The popularity of Android, in conjunction with the openness of

the platform, has made it an attractive target for attackers [13]. The

antivirus and research community have responded to this increas-

ing security concern through malicious app analysis services and

tools. Google has also created Bouncer [1], a service that auto-

matically scans and detects malicious apps. Scanning an app for

inferring its potentially hidden malicious activities can be based on

static [22, 25] and dynamic analysis [14, 17, 19, 28]. Unfortunately

both static and dynamic analysis approaches can be evaded. As

far as static analysis is concerned, researchers have demonstrated

a series of techniques which can exploit currently available analy-

sis tools [30]. As we demonstrate in this work, dynamic analysis

using emulation for inspecting Android malware is not perfect ei-

ther. A malicious program can try to infer whether it runs in an

emulated environment, and therefore evade detection by pausing

all malicious activities.

Speciﬁcally, in this paper we investigate how Android applica-

tions can infer whether they are running on an emulated ARM ar-

chitecture or on actual hardware. We begin with the creation of

Permission to make digital or hard copies of all or part of this work for personal or

classroom use is granted without fee provided that copies are not made or distributed

for proﬁt or commercial advantage and that copies bear this notice and the full cita-

tion on the ﬁrst page. Copyrights for components of this work owned by others than

ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re-

publish, to post on servers or to redistribute to lists, requires prior speciﬁc permission

and/or a fee. Request permissions from Permissions@acm.org.

EuroSec’14, April 14 - 17 2014, Amsterdam, Netherlands.

http://dx.doi.org/10.1145/2592791.2592796.

a taxonomy of possible ways for identifying features of the exe-

cution environment using sets of heuristics. Our heuristics span a

wide spectrum of sophistication. Many of them are simple, and can

be thwarted by simple modiﬁcations to the emulated environment

for confusing the heuristic, such as using realistic values for static

properties like the serial number of the device. Others are more

robust, as the emulated environment needs to incorporate realistic

output of mobile sensors, such as the accelerometer. Finally, we

present a set of heuristics that require design changes in the actual

emulated environment to be defeated.

To assess the importance of our ﬁndings we repackaged a set of

actual malware samples, by incorporating the developed heuristics,

and submitted them to online analysis tools. Surprisingly, all of the

tested analysis tools could be evaded using some of our heuristics.

There was no single malware analysis service that could cope with

all of the tested heuristics. Furthermore, at least 5 of the 12 analy-

sis tools we checked can be evaded by using heuristics as simple as

checking the IMEI value. More complex heuristics based on virtual

machine intricacies could evade all but four of the tested services.

Those four services do not support native code, and thus can only be

used by reviewing a subset of Android apps. Finally, all tested ser-

vices were vulnerable to sensor-based heuristics. We argue that cur-

rent practices for malware analysis can be easily evaded by demon-

strating that actual malware can conceal its malicious functionality

from publicly available malware analysis services. We propose a

set of countermeasures for making emulated Android app analysis

environment more robust to evasion attempts.

2. ANTI-ANALYSIS TECHNIQUES

Anti-analysis techniques that can be employed by Android apps

to evade detection can be classiﬁed in three categories: (a) static

heuristics, based on static information always initialized to ﬁxed

values in the emulated environment, (b) dynamic heuristics, based

on observing unrealistic behavior of various sensors, and (c) hy-

pervisor heuristics, based on incomplete emulation of the actual

hardware. Table 1 provides a summary of all categories, along with

some representative examples.

2.1 Static Heuristics

The static set includes heuristics that can be used for detecting

emulated environments by checking the presence and the content

of unique device identiﬁers, such as the serial number (device ID),

the current build version, or the layout of the routing table.

Device ID. Each smartphone contains an IMEI (International Mo-

bile Station Equipment Identity), which is a unique number identi-

fying it in the GSM network. The IMEI has already been used by

malicious Android apps to hinder analysis by malware detection

tools running on emulators [2]. Another mobile device identiﬁer is

下载后可阅读完整内容，剩余5页未读，立即下载

饭饭之正版麻子

粉丝: 0
资源: 3

安卓恶意软件对抗虚拟机检测：动态分析新挑战

数据库基础测验20241113.doc

微信小程序下拉选择组件

DICOM文件+DX放射平片-数字X射线图像DICOM测试文件

Jupyter Notebook《基于双流 Faster R-CNN 网络的 图像篡改检测》+项目源码+文档说明+代码注释

使用epf捕获没有CA证书的SSLTLS明文（LinuxAndroid内核支持amd64arm64）.zip

(源码)基于Arduino的天文数据库管理系统.zip

(源码)基于JSP和SQL Server的维修管理系统.zip

devecostudio-windows-3.1.0.501.zip

《计算机视觉技术》实验报告-8.1提取车辆轮廓

springboot小徐影城管理系统(代码+数据库+LW)

最新资源

Jupyter Notebook《基于双流 Faster R-CNN 网络的图像篡改检测》+项目源码+文档说明+代码注释