Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Google Researcher Unpacks Rare Android Malware Obfuscation Library

Analysis exposes the lengths malware authors will go to in order to protect their code from disassembly and reverse engineering.

A malware sample that had code in all the wrong places piqued Maddie Stone's curiosity. So she dug into the sample and emerged many hours later with a description of a complex anti-analysis library that threat actors are using to, among other things, give new life to old threats.

"I came across this app that had a native code library, which is not that common in the Android security space where I was doing the malware analysis," says Stone, a security engineer for Google Android security. "It was strange compared to all the other ones I've looked at before — nothing looked where it should have been." 

As she dug deeper and deeper into the code, Stone became more interested because of the novelty of the defense mechanisms. "I found that this was actually a brand new anti-analysis library being used by a few large malicious campaigns in the Android ecosystem," she says. And it wasn't just new — it was very complex.

[See Stone's session, Unpacking the Packed Unpacker: Reverse Engineering an Android Anti-Analysis Native Library on Thursday, August 9 at Black Hat USA.]

"They're using four groups of techniques for about 45 different checks. And if a single one of them fails then the application exits," Stone says. The rigorous checking mechanism means that the threat actors are willing to miss out on an expanded attack surface if it means keeping their code out of the hands of defenders.

Stone, who will present her findings next week at Black Hat USA in Las Vegas, describes the defense architecture as a "wedding cake" because there are many layers to the defense. The first is aimed at thwarting human analysts, the second at humans using automated systems, and the third autonomous systems running alone.

"They're really trying to hedge their bets and ensure that there's no way, shape, or form that they could be run in an emulator or debugger, and that if I reverse engineer and am going to take the time to disassemble them, it's really going to take a lot of work," she says.

What malware is so valuable that it warrants delivering with such an advanced mechanism? Stone says that one of the primary campaigns she's seen uses this library to re-launch Chamois, a Trojan that Google engineers were able to shut down in 2017. The attackers haven't tried to get back into Play, but are depending on users willing to side-load software to gain entry to a particular Android phone, she says.

As with side-loading itself, the individual mechanisms used in this malware family aren't novel or unique; the novelty comes from the sheer volume and combination of techniques used to protect the payload.

"We're seeing a lot more of both native and Java obfuscation and trying to cloak themselves and prevent any sort of dynamic analysis of the application," Stone says. "As there's no longer this low, low hanging fruit for security, the malware authors have to continue developing more robust schemes." 

The priorities shown in the mechanisms are a reflection, Stone says, of the value of the investment malware represents. Malware development and reverse engineering are each forms of asymmetric warfare, each side trying to force the other to invest more and more to counter their own efforts.

"As the Android platform security mechanisms have continued to grow in how our detection pipeline will be able to catch more things, they're trying to do anything they can to get around the automated detection, because that's what so many different malware detectors are using now," she says.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13157
PUBLISHED: 2019-11-22
nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive.
CVE-2012-2079
PUBLISHED: 2019-11-22
A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
CVE-2019-11325
PUBLISHED: 2019-11-21
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
CVE-2019-18887
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
CVE-2019-18888
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. T...