+ All Categories
Home > Documents > Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke...

Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke...

Date post: 04-Aug-2020
Category:

Documents
Upload: others
View: 0 times
Download: 0 times
Download Report this document
Share this document with a friend
49
Malware in Mobile Platform from Panoramic Industrial View Antiy Labs
Transcript
Page 1: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Malware in Mobile Platform from

Panoramic Industrial View

Antiy Labs

Page 2: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Contents

introduction •a piece of “news” + a mobile phone

phenomenon •new threat

solution • Is everything under control?

analysis •the history of confrontation

conclusion •conclusion

Page 3: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

INTRODUCTION:

A PIECE OF “NEWS”+ A MOBILE PHONE

Page 4: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Talking From A Piece of “News”

Page 5: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Analysis

Page 6: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Taking from a Grey Mobile Phone

恶意行为

Extra Expenses Customize

Extra Services

Network Flows

Download Other Software

Website Hits

Privacy Steal Message,

Contacts list

Page 7: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Analysis on Malware Information

Name com.google.android.providers.enhancedgooglesearch

Chinese Name

Original Name a.apk

URL Source

Collection

Source

System

Platform Android

Format apk

MD5 Value BFBB58D0F8B487869393A0244AE71AFC

CRC32 Value C1C12A99

SHA1 Value 59EE114166CDBCDDB88B38299934021080053D86

Bytes

Malware Information

Name Trojan/Android.droiddg.a[rmt,sys]

CNCERT Name a.remote.droiddg.a

Chines Name

Other Names None

Original/Tied Firmware embedding

Threat type remote system

Page 8: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

A Truely Funny Story

A grey Android mobile

A sexy E-market

Real E-market

Genuine mobile

Page 9: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Diverted Industrial Chain

Page 10: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

INTERPRETATIONS OF NEW THREATS

Page 11: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Crossing the System Platform(Zitmo)

Zitmo

Android

Symbian

WinCE

Zeus Windows

attacker

account/password

random identifying code

Net Bank

RIM OS

Page 12: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Steal Message and Contacts List (SW.Spyware)

Propagation Means

– Disguise as Tax Amount Calculating Software Package Calculating

Procedure

– Installation

– Model as QQ Loginform to Lure Uses

– Get the Account and Password of QQ and Send to Some Specific Mobile Phone

Object system

– Android

Harm

– Steal Message Contetns

– The SW.Spyware.B Variant Can Even Monitor the Communication Record of User

Damage Range

– First version of Android virus

Propagaton Time

– July, 2010

Page 13: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Spycall (Nickispy)

• Spycall and send back

• Disguise as Google+

in the First Time

2011/09/17 第13页

Page 14: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Form Control System(Adrd)

• Trojan/Android.Adrd.a[exp]

Issue the control command and the malware trigger command

Provide the data-accessing address URL needed by

malware behavior

Provide the parameter data needed by malware behavior

Provide updating service for malware files

Page 15: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

the interdisciplinary use of leak and social engineering

1. Replace normal application

by means of Google

application download bug

2. Consumers download bootleg

applications which are actually

malware, with 200 thousand

victims.

3.Google clears out malware by

remote upgrade interplay and

provides security software

4.The malware attacker

disguises as Google security

software

Page 16: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

SOLUTION：

IS EVERYTHING UNDER CONTROL

Page 17: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Traditional view

Mobile malware

SIS

APK

PE

………

Android

SymbOS

Windows Mobile

Various media

Malware

Host format

System entrance

Spreading media

Page 18: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Major Spreading Approaches

• User Flash

• Vendor pre-setting up

• Flash memory share

• USB communication

•GPRS/3G

•Wi-Fi

•PC shared network

• Official

market/network

• Third-party market

• Message/multimedia

message User installation

Internet

download

Inserting ROM

PC penetration

第18页

Page 19: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Dalvik Disassembling: IDA Pro

第19页

Page 20: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Static Analysis: ARM Disassembling

第20页

Page 21: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Static Analysis: Java Decompilation

2011/09/20 第21页

Page 22: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Dynamic Analysis: SDK Simulator

第22页

Page 23: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Dynamic Analysis: Behavior Monitor

第23页

Page 24: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Network Analysis

第24页

Page 25: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Automatic Analysis

第25页

Page 26: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Disassembling Dalvik Code

第26页

Page 27: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Disassembling Dalvik Code

第27页

Page 28: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Disassembling ARM Code

第28页

Page 29: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Decompilation as Java

第29页

Page 30: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

System Simulation

第30页

Page 31: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Network Data Analysis

第31页

Page 32: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Dynamic Behavior Monitor

第32页

Page 33: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Automatic Comprehensive Analysis

第33页

Page 34: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Visualized Comprehensive Analysis

第34页

Page 35: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

ANALYSIS:

THE HISTORY OF CONFRONTATION

Page 36: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Those Forgotten Grey Faces ？

CIH 1998

Melisa 1999

Sasser 2004

Page 37: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Those Forgotten Red Alert ？

Page 38: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

A Cross-Platform Contrast

2001 2010

Page 39: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Winux（2001）

Page 40: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Cross Platform-Mobile + PC Bimorphism

912812352001_3rd.sisx SymbianUpdateSrv.exe

dlinstall.dat （sisx）

install.dat20

（sisx）

0xe61caca0.dat （jar）

class files symbianDL.exe

symbianStarter.exe symbianSrv.exe

symbianChkServer.exe

start and update new module

download module

service-monitoring module

clearing module

heartbeat telecontrol module

Function disguising module

Page 41: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

The Confrontation History Since 1988

Normalized Confrontation

Systematical Confrontation

Industrial Confrontation

Page 42: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Notable Event and Typical Method of Normalized Confrontation

• Bouncing Ball Virus

• Encrypted Virus

• Metamorphic Virus

• Script Virus

• Macro Virus

• Pattern Matching Penetrated

• Difficulty Promoted

• Direct Attack Mechanism

• Disrupting the Wording Chain

• Interfering Mechanism

• Normalized Confrontation

Page 43: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Normalized Confrontation

Object obataining

Solution

Virus database

framework current diverter

preprocessor matching box

assessor disposer

Page 44: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Systematical confrontation（2000～2005）

Page 45: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Systematical confrontation (notable event)

The Emerge of P2P Zombie Network

The Application of PKI System in Zombie Network

Attack on VirusTotal by distributed DDos

Shift from Client to Could Port

Page 46: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Industrial Confrontation (2005—Now)

underground industrial

system

information industrial

system

Page 47: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

underground industrial

player

invade enterprise

server steal secret sale

invade server network games

steal virtual currency steal account

invade website massively

compile malware

spreading

steal bank account

launder money

steal network exchange account

steal virtual property

incorporate Zombie network

send rubbish e-mail

reject service attack

charge spread

obtain money

An Integral Whole Seen from Underground Economy Chain

forum spread tying spread

SP expense deducting

mobile malware code

Compile mobile malware

Page 48: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Industrial Chain: Complex and Interminable

48

baseband chip

solution OS spare-parts

sale approach

application software

content supplier

service supplier

Software supplier

manufacturing

Qualcomm TI

ARM MemoryBattery

Symbian、WM、Macos、android、

palm……

genuine product grey product

custom and tie

TechFaith DaTang

……

official after-sale

private service

sale service

app store

personal

enterprise

security vendors

Page 49: Malware in Mobile Platform from Panoramic Industrial View · Malware has developed and broke through the traditional single concept of program code. It has penetrated into the whole

Summary

Malware has developed and broke through the

traditional single concept of program code. It has

penetrated into the whole system of society, politics,

economy and life. It is impossible to resist malware

effectively only relying on anti-virus vendors. The

battle against malware requires the management and

resistance of the whole social system.

Anti-virus men of all countries, unite!

Thank you!

[email protected]


Recommended
Panoramic imaging

Panoramic imaging

Healthcare

Panoramic radiography. 1952, Paatero 1960 2002 Development of Panoramic radiogaphy.

Panoramic radiography. 1952, Paatero 1960 2002 Development of Panoramic radiogaphy.

Documents

PANORAMIC ADAPTER

PANORAMIC ADAPTER

Documents

Panoramic Resort

Panoramic Resort

Documents

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Documents

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Documents

Durmitor Ring - Panoramic Roads of Montenegro · 2020. 3. 24. · DURMITOR RING PANORAMIC ROADS free map PANORAMIC ROADS WELCOME Montenegro‘s Panoramic Roads lead you through the

Durmitor Ring - Panoramic Roads of Montenegro · 2020. 3. 24. · DURMITOR RING PANORAMIC ROADS free map PANORAMIC ROADS WELCOME Montenegro‘s Panoramic Roads lead you through the

Documents

Panoramic Balustrade

Panoramic Balustrade

Documents

Spectacularphotos.e - panoramic

Spectacularphotos.e - panoramic

Travel

Power System Stabilization of a Grid Highly Penetrated ...

Power System Stabilization of a Grid Highly Penetrated ...

Documents

SLIMLINE, PANORAMIC & PANORAMIC PLUS Veranda...info@betteroutdoors.com 01923 932 492 01923 701 150 TEL : FAX : Veranda INSULATED, SLIMLINE, PANORAMIC & PANORAMIC PLUS At Better Outdoors

SLIMLINE, PANORAMIC & PANORAMIC PLUS [email protected] 01923 932 492 01923 701 150 TEL : FAX : Veranda INSULATED, SLIMLINE, PANORAMIC & PANORAMIC PLUS At Better Outdoors

Documents

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents

London - panoramic

London - panoramic

Travel

panoramic map

panoramic map

Documents

Panoramic London

Panoramic London

Documents

Panoramic iceland

Panoramic iceland

Documents

Panoramic Technique

Panoramic Technique

Documents