Dunham / Hartman / Quintans Android Malware and Analysis

1. Auflage 2014
ISBN: 978-1-4822-5220-0
Verlag: Taylor & Francis
Format: PDF
Kopierschutz: Adobe DRM (»Systemvoraussetzungen)

E-Book, Englisch, 242 Seiten

The rapid growth and development of Android-based devices has resulted in a wealth of sensitive information on mobile devices that offer minimal malware protection. This has created an immediate demand for security professionals that understand how to best approach the subject of Android malware threats and analysis.

In Android Malware and Analysis, Ken Dunham, renowned global malware expert and author, teams up with international experts to document the best tools and tactics available for analyzing Android malware. The book covers both methods of malware analysis: dynamic and static.

This tactical and practical book shows you how to use to use dynamic malware analysis to check the behavior of an application/malware as it has been executed in the system. It also describes how you can apply static analysis to break apart the application/malware using reverse engineering tools and techniques to recreate the actual code and algorithms used.

The book presents the insights of experts in the field, who have already sized up the best tools, tactics, and procedures for recognizing and analyzing Android malware threats quickly and effectively. You also get access to an online library of tools that supplies what you will need to begin your own analysis of Android malware threats. Tools available on the book’s site include updated information, tutorials, code, scripts, and author assistance.

This is not a book on Android OS, fuzz testing, or social engineering. Instead, it is about the best ways to analyze and tear apart Android malware threats. After reading the book, you will be able to immediately implement the tools and tactics covered to identify and analyze the latest evolution of Android threats.

Zielgruppe

IT professionals involved with network, computer, and device security and forensics.

Autoren/Hrsg.

Dunham, Ken

Hartman, Shane

Quintans, Manu

Morales, Jose Andre

Strazzere, Tim

Fachgebiete

• Mathematik | Informatik EDV | Informatik Programmierung | Softwareentwicklung Software Engineering

Inhaltsverzeichnis

Introduction to the Android Operating System and Threats
Android Development Tools
Risky Apps
Looking Closer at Android Apps

Malware Threats, Hoaxes, and Taxonomy
2010
FakePlayer
DroidSMS
FakeInst
TapSnake
SMSReplicator
Geinimi
2011
ADRD
Pjapps
BgServ
DroidDream
Walkinwat
zHash
DroidDreamLight
Zsone
BaseBridge
DroidKungFu
GGTracker
jSMSHider
Plankton
GoldDream
DroidKungFu2
GamblerSMS
HippoSMS
LoveTrap
Nickyspy
SndApps
Zitmo
DogWars
DroidKungFu3
GingerMaster
AnserverBot
DroidCoupon
Spitmo
JiFake
Batterydoctor
2012
AirPush
Boxer
Gappusin
Leadbolt
Adwo
Counterclank
SMSZombie
NotCompatible
Bmaster
LuckyCat
DrSheep
2013
GGSmart
Defender
Qadars
MisoSMS
FakeRun
TechnoReaper
BadNews
Obad
2014
DriveGenie
Torec
OldBoot
DroidPack

Open Source Tools
Locating and Downloading Android Packages
Vulnerability Research for Android OS
Antivirus Scans
Static Analysis
Linux File Command
Unzip the APK
Strings
Keytool Key and Certificate Management Utility
DexID
DARE
Dex2Jar
JD-GUI
JAD
APKTool
AndroWarn
Dexter
VisualThreat
Sandbox Analysis
AndroTotal
APKScan
Mobile Malware Sandbox
Mobile Sandbox
Emulation Analysis
Eclipse
DroidBox
AppsPlayground
Native Analysis
Logcat
Traceview and Dmtracedump
Tcpdump
Reverse Engineering
Androguard
AndroidAuditTools
Smali/Baksmali
AndBug
Memory Analysis
LiME
Memfetch
Volatility for Android
Volatilitux

Static Analysis
Collections: Where to Find Apps for Analysis
Google Play Marketplace
Marketplace Mirrors and Cache
Contagio Mobile
Advanced Internet Queries
Private Groups and Rampart Research Inc.
Android Malware Genome Project
File Data
Cryptographic Hash Types and Queries
Other Metadata
Antivirus Scans and Aliases
Unzipping an APK
Common Elements of an Unpacked APK File
Certificate Information
Permissions
Strings
Other Content of Interest within an APK
Creating a JAR File
VisualThreat Modeling
Automation
(Fictional) Case Study

Android Malware Evolution

Android Malware Trends and Reversing Tactics

Behavioral Analysis
Introduction to AVD and Eclipse
Downloading and Installing the ADT Bundle
The Software Development Kit Manager
Choosing an Android Platform
Choosing a Processor
Using HAXM
Configuring Emulated Devices within AVD
Location of Emulator Files
Default Image Files
Runtime Images: User Data and SD Card
Temporary Images
Setting Up an Emulator for Testing
Controlling Malicious Samples in an Emulated Environment
Additional Networking in Emulators
Using the ADB Tool
Using the Emulator Console
Applications for Analysis
Capabilities and Limitations of the Emulators
Preserving Data and Settings on Emulators
Setting Up a Physical Device for Testing
Limitations and Capabilities of Physical Devices
Network Architecture for Sniffing in a Physical Environment
Applications for Analysis
Installing Samples to Devices and Emulators
Application Storage and Data Locations
Getting Samples Off Devices
The Eclipse DDMS Perspective
Devices View
Network Statistics
File Explorer
Emulator Control
System Information
LogCat View
Filtering LogCat Output
Application Tracing
Analysis of Results
Data Wiping Method
Application Tracing on a Physical Device
Imaging the Device
Other Items of Interest
Using Google Services Accounts
Sending SMS Messages
Getting Apps from Google Play
Working with Databases
Conclusion

Building Your Own Sandbox
Static Analysis
Dynamic Analysis
Working Terminology for an Android Sandbox
Android Internals Overview
Android Architecture
Applications
Applications Framework
Libraries
Android Runtime
The Android Kernel
Build Your Own Sandbox
Tools for Static Analysis
Androguard
Radare2
Dex2Jar and JD-GUI
APKInspector
Keytool
Tools for Dynamic Analysis
TaintDroid
DroidBox
DECAF
TraceDroid Analysis Platform
Volatility Framework
Sandbox Lab (Codename AMA)
Architecture
Host Requirements
Operating System
Configuration
Running Sandbox
What Happens When You Upload Malware Samples, from a Dynamic Analysis Point of View
Conclusions about AMA

Case Study Examples
Usbcleaver
Checkpoint
Static Analysis
Checkpoint
Dynamic Analysis
Launch of the APK
Summary
Torec

Bibliography

Index

Über Autor(innen)

Patricia A. Gabow, MD, MACP, was CEO of Denver Health from 1992 until her retirement in 2012, initially transforming it from a department of city government to a successful, independent governmental entity and then leading its Lean transformation. Denver Health’s Lean effort earned the Shingo Bronze Medallion for Operational Excellence, the first healthcare entity in the world to receive such recognition. Prior to becoming CEO, Dr. Gabow was a practicing nephrologist and academic researcher serving as chief of nephrology, director of medical services, and chief medical officer at Denver Health. Dr. Gabow is a member of the Medicaid and CHIP Payment and Access Commission (MACPAC), the Robert Wood Johnson Foundation Board of Trustees, the Institute of Medicine Roundtable on Value and Science Driven Health Care, the National Governors’ Association Health Advisory Board, and a senior advisor to Simpler. She is a professor of medicine at the University of Colorado School of Medicine and has authored more than 150 articles and book chapters. She earned her MD degree from the University of Pennsylvania School of Medicine. She has received numerous awards including the AMA Nathan Davis Award for Outstanding Public Servant, the National Healthcare Leadership Award, the David E. Rogers Award from the Association of American Medical Colleges (AAMC), the Health Quality Leader Award from the National Committee for Quality Assurance (NCQA), and was elected to the Association for Manufacturing Excellence for her work in bringing Lean into healthcare.

Philip L. Goodman, MS, RRT, was the director of the Lean Systems Improvement Department at Denver Health, overseeing the Lean facilitators and Lean educational initiatives. In this role he led the operational aspects of the Lean transformation effort, the Black Belt training program, and the Lean Academy at Denver Health. Goodman was employed at Denver Health from 1979 until his retirement in 2013. Prior to directing the Lean Systems Improvement Department, he was the service line administrator for the Department of Medicine and director of respiratory therapy at Denver Health. Goodman is a Denver Health Master Black Belt and a registered respiratory therapist.

He earned his master’s degree in healthcare administration from Regis University in Denver. Goodman has conducted numerous presentations of Denver Health’s Lean transformation effort at the national level.