book

The Android Malware Handbook

by Qian Han, Salvador Mandujano, Sebastian Porst, V.S. Subrahmanian, Sai Deep Tetali

November 2023

Intermediate to advanced

328 pages

9h 5m

English

No Starch Press

Read now

Unlock full access

Cover Page
Title Page
Copyright Page
About the Authors
About the Technical Reviewer
BRIEF CONTENTS
CONTENTS IN DETAIL
FOREWORD
ACKNOWLEDGMENTS
INTRODUCTION
Who Should Read This BookWhat You’ll Find in This Book

PART I A PRIMER ON ANDROID MALWARE
1 THE BASICS OF ANDROID SECURITY
The Android Security ModelApplication IsolationAttack Surface ReductionExploit MitigationDevice IntegrityPermissionsSecurity UpdatesAdd-on Security and Safety ServicesCollaboration Across GoogleSideloaded and Preloaded Malware ProtectionThe Android PackageCategories of Android MalwareDenial of ServiceBackdoorsRootingTrojansSpywareStalkerwarePhishingHostile DownloadersPrivilege EscalationRansomwareSMS FraudToll FraudCall FraudSpamAd FraudNon-Android ThreatsUp Next
2 ANDROID MALWARE IN THE WILD
The Early Years: 2008 to 2012DroidSMSDroidDreamThe Wallpaper FamilyThe Camera FamilyCricketlandDougaleakerBeeKeeperDogowarOther Early Android MalwareThe Professionalization of Malware: 2013 and 2014Ghost PushBadNews, RuFraud, and RuPlayWallySMSMono WAPCryptocurrency MalwareTaicliphotThe First Preinstalled MalwareThe Rise of Large Malware Networks: 2015 and 2016Turkish ClickerGaiaphishJudyDressCodeJokerTriadaChamoisGooligan and SnowfoxHummingbadYouTube DownloaderThe Consolidation of Abuse: 2017 and OnwardOneAudienceAndroid.Click.312.originCheetah MobileAnti-Fraud SDKsLoapi/PodecHDC BookmarkEagerFontsGMobiAdupsRedstoneDigitimeUp Next
PART II MANUAL ANALYSIS
3 STATIC ANALYSIS
What Is Static Code Analysis?Guided vs. Unguided AnalysisKnowing When You’re DoneLoading the Malware Sample into jadxMalicious Code in the PermissionsViewing the PermissionsFinding the APIs Gated by PermissionsAnalyzing the READ_CONTACTS PermissionAnalyzing the BIND_NOTIFICATION_LISTENER_SERVICE PermissionMalicious Code in App Entry PointsExported ActivitiesBroadcast ReceiversServicesApplication SubclassesHiding Malicious CodeAnti-Analysis TechniquesReflectionNon-Java CodeEncryption and EncodingThe Malware’s First StageUnderstanding the Malicious ClassReverse Engineering the String Decryption MethodDecrypting All Strings in the ClassThe Malware’s Second StageEntry PointsThe yin.Chao.yin MethodThe com.* PackageThe Malware’s Third Stagejadx Decompilation IssuesEntry PointsName ManglingCommand-and-Control Server CommunicationExamining the Encryption AlgorithmProbing the Server from the Command LineRegistering with the ServerProcessing the Registration ResponseDownloading CommandsProcessing the Command-and-Control Server’s ResponseSecretly Signing Up for the Premium ServiceSetting Up the JavaScript BridgeInteracting with the Java Bridge ObjectCompleting the Sign-up ProcessThe Mysterious Fourth StageUp Next
4 DYNAMIC ANALYSIS
What Is Dynamic Code Analysis?Dynamic vs. Static AnalysisThe Android Studio EmulatorCreating a System ImageStarting the EmulatorResetting the EmulatorInteracting with the EmulatorDynamic Analysis ToolstcpdumpWiresharkFridaThe Malware SampleDetecting Malicious FunctionalityObserving Filesystem ChangesDownloading Files for InspectionCapturing Network TrafficAnalyzing Network TrafficAnalyzing Logs with LogcatAnalysis with FridaRunning frida-serverUsing frida-trace to Find Interesting APIsFinding Entry Points into the Malware with Frida ScriptingExecuting the Frida ScriptDecrypting the Command-and-Control CommunicationsWith CyberChefWith FridaCommand-and-Control Server MessagesThe /ping URLThe /metrics URLThe Rotating Encryption KeysOther Malware Functionalitycom.sniff with frida-traceAccessibility AbuseAdding Static AnalysisOther Command-and-Control ServersOther Server CommandsMore Accessibility AbuseAutomatically Granting PermissionsInjecting Phishing WindowsStealing CredentialsUp Next
PART III MACHINE LEARNING DETECTION
5 MACHINE LEARNING FUNDAMENTALS
How Machine Learning for Malware Analysis WorksIdentifying App FeaturesCreating Training SetsUsing Classification AlgorithmsClassification AlgorithmsDecision TreesBagging and Random ForestSupport Vector Machinesk-Nearest NeighborsNaive BayesEvaluating Machine Learning ModelsStruggles of Machine Learning ClassifiersIdentical Feature VectorsBalance vs. ImbalanceInterpretabilityCross-Validation vs. Rolling Window PredictionUp Next
6 MACHINE LEARNING FEATURES
Static FeaturesDynamic FeaturesMethod Call Features (A Weak Tactic)Triadic Suspicion Graph FeaturesSuspicion ScoresThe Suspicion RankTSG FeaturesLandmark-Based FeaturesSelecting LandmarksComputing Landmark-Based FeaturesFeature ClusteringGenerating Feature ClustersChoosing Clustering and Feature Aggregation AlgorithmsCorrelation Graph–Based Feature TransformationFurther ReadingUp Next
7 ROOTING MALWARE
Rooting Malware FamiliesTesting Classifier PerformanceRooting Malware vs. GoodwarePermission-Related FeaturesNetwork-Based FeaturesRooting Malware vs. Other MalwarePermission-Related FeaturesOther FeaturesDroidDream: A Case StudyUp Next
8 SPYWARE
Spyware FamiliesSpyware vs. GoodwarePermission-Related FeaturesPrediction EfficacySpyware vs. Other MalwarePermission-Related FeaturesPrediction EfficacyQibla Compass Ramadan: A Case StudyPredictions for Spyware AppsUp Next
9 BANKING TROJANS
Banking Trojan FamiliesBanking Trojans vs. GoodwareSMS Permission FeaturesOther Permission FeaturesPrediction EfficacyBanking Trojans vs. Other MalwarePermission-Related FeaturesPrediction EfficacyMarcher: A Case StudyUp Next
10 RANSOMWARE
How Ransomware Attacks WorkAndroid Ransomware FamiliesRansomware vs. GoodwarePermission-Related FeaturesOther FeaturesPrediction EfficacyRansomware vs. Other MalwarePermission-Related FeaturesPrediction EfficacySimplocker: A Case StudyPredictions for Important Ransomware SamplesUp Next
11 SMS FRAUD
SMS Fraud vs. GoodwareNon-SMS PermissionsThe Absence of SMS PermissionsPrediction EfficacySMS Fraud vs. Other MalwarePermission-Related FeaturesPrediction EfficacyBeeKeeper: A Case StudyPredictions for SMS Fraud SamplesUp Next
12 THE FUTURE OF ANDROID MALWARE
Windows vs. AndroidWindowsAndroidHiding Malicious Behavior with Anti-Analysis TechniquesNative ARM CodeDownloaded ModulesLess Popular LanguagesSDK-less TechniquesDistributionPreloaded Malware and Supply Chain CompromisesSmarter SideloadingMalware EconomicsMachine Learning Trends for Attackers and DefendersNext Steps
INDEX

Content preview from The Android Malware Handbook

4DYNAMIC ANALYSIS

This chapter uses a malware sample from the Xenomorph phishing family, first described by Dutch security company ThreatFabric in March 2022, to introduce popular dynamic analysis tools for Android and best practices for using these tools. We cover the use of a device emulator to run the malicious app, as well as the use of tcpdump, Wireshark, and Frida to learn about the app’s behavior.

In any serious reverse engineering context, analysts use static and dynamic techniques in tandem to speed up malware analysis. Thus, toward the end of this chapter, we’ll supplement our dynamic analysis with static analysis in jadx. You’ll witness ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory

Publisher Resources

ISBN: 9781098168575

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

The Android Malware Handbook

by Qian Han, Salvador Mandujano, Sebastian Porst, V.S. Subrahmanian, Sai Deep Tetali

4DYNAMIC ANALYSIS

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.