Slashdot Mirror


Researchers 'Map' Android Malware Genome

yahoi writes "Researchers at NC State are sharing their analysis and classification of Android malware samples under a new project that they hope will help shape a new way of fighting malware, learning from the lessons of the PC generation and its traditional anti-malware products. Xuxian Jiang, the mastermind behind the Android Malware Genome Project, says defenses against this malware today are hampered by the lack of efficient access to samples (PDF), as well as a limited understanding of the various malware families targeting the Android. The goal is to establish a better way of sharing malware samples and analysis, and developing better tools to fight it, he says."

46 of 67 comments (clear)

  1. Funny how things work out by Anonymous Coward · · Score: 5, Insightful

    Remember how Slashdot spent 10+ years mocking Windows for being a malware-laden cesspool of unremovable OEM junkware with an antivirus industry built around it? Embarrassed yet?

    1. Re:Funny how things work out by rampant+mac · · Score: 2

      " help shape a new way of fighting malware, learning from the lessons of the PC generation and its traditional anti-malware products. "

      "Remember how Slashdot spent 10+ years mocking Windows for being a malware-laden cesspool of unremovable OEM junkware with an antivirus industry built around it?"

      Yep, came here to basically say the same thing. I can't believe my phone would need a virus scanner. What's next? Android Security Essentials 2012?

      --
      I like big butts and I cannot lie.
    2. Re:Funny how things work out by __aaltlg1547 · · Score: 2

      Virus scanners like they have on Windows would destroy the platform. Phones don't have unlimited battery to throw at security.

    3. Re:Funny how things work out by __aaltlg1547 · · Score: 1, Flamebait

      Wake me up when another Linux variant runs on my phone and doesn't have the same vulnerabilities as Android.

    4. Re:Funny how things work out by Calos · · Score: 1

      And which vulnerabilities are those?

      I was under the impression that most Android malware was of the trojan variety. It doesn't exploit any vulnerabilities in Android, it exploits the users' stupidity. Things you download from the market list the permissions. If a wallpaper app wants access to your accounts, SMS, contacts, phone ID, etc., you install it at your peril.

      I'm sure there are other vulnerabilities. But as far as I'm aware they are in the minority. Could be wrong.

      --
      I vote based on politicians' actions, unless contrary to my preconceptions. Often wrong, never uncertain. #iamthe99%
    5. Re:Funny how things work out by ozmanjusri · · Score: 2

      I can't believe my phone would need a virus scanner. What's next?

      Depends how firm a grip you have on reality.

      In the first half of 2011, the lion share of malware was once again written for Windows systems.

      Only one in two hundred and fifty malware programs is not a Windows program file. The proportion of classic Windows program files (Win32) continues to drop. However, .NET programs (MSIL) compensate for this loss of 0.3% and the overall share of Windows malware programs is on the rise.

      1 Win32 1.218.138 97,8 %
      2 MSIL 21.736 1,7 %
      3 WebScripts 3.123 0,3 %
      4 Scripts 832 0,1 %
      5 Mobile 803 0,1 %
      6 Java 313 7 *ix 4 233 8 NSIS 131

      http://www.gdatasoftware.co.uk/uploads/media/G_Data_MalwareReport_H1_2011_EN.pdf

      --
      "I've got more toys than Teruhisa Kitahara."
    6. Re:Funny how things work out by __aaltlg1547 · · Score: 1

      Wy bothter to exploit anything else when you can get the user to download and install your shit?

    7. Re:Funny how things work out by Calos · · Score: 1

      Yeah, that's pretty much how it works.

      That's why I was questioning why you wanted to be [woken] up when another Linux variant runs on [your] phone and doesn't have the same vulnerabilities as Android. The two notions are incongruent. That's why I was asking about specific vulnerabilities, because I wasn't aware of it really being an issue.

      --
      I vote based on politicians' actions, unless contrary to my preconceptions. Often wrong, never uncertain. #iamthe99%
    8. Re:Funny how things work out by ozmanjusri · · Score: 4, Interesting
      When you strip the anti-malware vendor hype away, the threat's a lot smaller than most people realise.

      Some of the biggest "infections" weren't really malware at all. Kindsight Security Labs Malware Report for Q1 2012 says:

      Without Plankton/Apperhand (no longer classified as malware) included in the infection statistics, mobile device infection has actually leveled off in the first quarter of 2012. We believe that this trend in mobile device infections will not last as the target is too tempting to hackers

      http://www.kindsight.net/sites/default/files/Kindsight_Security_Labs-Q112_Malware_Report-final.pdf

      --
      "I've got more toys than Teruhisa Kitahara."
    9. Re:Funny how things work out by symbolset · · Score: 1

      Oh, we're not done with that one yet.

      --
      Help stamp out iliturcy.
    10. Re:Funny how things work out by Anonymous Coward · · Score: 1

      Remember how Slashdot spent 10+ years mocking Windows for being a malware-laden cesspool of unremovable OEM junkware with an antivirus industry built around it? Embarrassed yet?

      Did something change? Windows is still the cesspool of malware and virus laden applications and it's responsible for most of the world's SPAM. It's also the preferred OS of Bots. It's so full of holes they need to release patches for it every week just to keep up with all of the zero days found.

    11. Re:Funny how things work out by Deorus · · Score: 1

      Haven't been using Linux for long, have you? I've had such things happen to me in the past, they were just targeted at Windows, but that didn't stop files named like c:\playerhost.dll from ending up in my home directory, on Linux. I guess you can say that I was saved by Linux's lack of popularity on the desktop, nothing else.

      You can claim that many of those vulnerabilities are gone now that Adobe has stopped developing Flash for Linux (as well as for mobile platforms), that address spaces are randomized, that compilers have evolved to generate hardened code by default, and that x86 now supports non-executable pages within code segments, but that's not always been the case, and if you're going to judge Windows for what it was, what it did, and what it does, then at least be unbiased in your judgement.

    12. Re:Funny how things work out by RaceProUK · · Score: 1

      Remember how Slashdot spent 10+ years mocking Windows for being a malware-laden cesspool of unremovable OEM junkware with an antivirus industry built around it? Embarrassed yet?

      Did something change? Windows is still the cesspool of malware and virus laden applications and it's responsible for most of the world's SPAM. It's also the preferred OS of Bots. It's so full of holes they need to release patches for it every week just to keep up with all of the zero days found.

      All because Windows has over 90% market share.

      If OSX or Linux had the same market share, then they'd see the vast majority of malware instead.

      --
      No colour or religion ever stopped the bullet from a gun
  2. Lemme guess by Taco+Cowboy · · Score: 3, Funny

    The malware genome points to Java ?

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:Lemme guess by binarylarry · · Score: 4, Funny

      I don't see slow in there anywhere...

      --
      Mod me down, my New Earth Global Warmingist friends!
  3. Wow, could you imagine... by freeweaver · · Score: 1

    the size of a Windows map?

    In fact, I don't think there's a super computer capable of mapping it.

    1. Re:Wow, could you imagine... by Anonymous Coward · · Score: 1

      Not only is your attempt to distract from Android malware criticism lame, it's not even accurate, as PC usage today is dwarfed by smartphones and tablets. So it would be Android's that is bigger...

    2. Re:Wow, could you imagine... by DarwinSurvivor · · Score: 2

      If you are going to demand a citation, your rebuttal better damn well include one! I'm not saying I dissagree, but your arrogance is definitely showing.

    3. Re:Wow, could you imagine... by causality · · Score: 1

      If you are going to demand a citation, your rebuttal better damn well include one! I'm not saying I dissagree, but your arrogance is definitely showing.

      Eh I don't know. He countered an assertion with another assertion. While he could have invested a trivial amount of effort to do much better, nonetheless they remain on equal ground.

      This is speculation, but perhaps that was the point?

      --
      It is a miracle that curiosity survives formal education. - Einstein
    4. Re:Wow, could you imagine... by ozmanjusri · · Score: 1
      Latest stats say last quarter Apple activated between 613,979 to 692,551 iOS devices per day, Android activated around 700,000/day, while Windows 7 averages out at about 650,000 licenses sold per day. All those numbers are questionable (for differing reasons), but are likely to be ballpark-close.

      Windows would have a much bigger installed base, since it's been on the market longer.

      http://techcrunch.com/2011/09/13/microsoft-sold-450-million-copies-of-windows-7/

      --
      "I've got more toys than Teruhisa Kitahara."
    5. Re:Wow, could you imagine... by similar_name · · Score: 1

      For your convenience Windows vastly out numbers other operating systems either by market share or by usage.

      Sourced from first hits (at least for me) on searches for operating system market share and operating system by usage respectively.

    6. Re:Wow, could you imagine... by symbolset · · Score: 1

      Here's an interesting article from last year: Microsoft admits that one in fourteen downloads are Windows malware.

      I would say Android is a long way from having anything like this sort of problem.

      --
      Help stamp out iliturcy.
    7. Re:Wow, could you imagine... by symbolset · · Score: 1
      --
      Help stamp out iliturcy.
  4. Apple's closed system by grantspassalan · · Score: 4, Insightful

    Why is it that there is no malware for IOS? There are millions of these devices out there, so there certainly is an incentive for malware writers.

    I believe that it has something to do with the fact that only Apple approved and checked software can be installed thereon. This closed system may not appeal to many here on /., but it is certainly as close as we have gotten to a malware proof computing experience we are likely to get anytime soon. Mac users will be able to enjoy this form of security with OS X 10.8 this summer.

    --
    A sufficiently advanced simulation is indistinguishable from reality.
    1. Re:Apple's closed system by Charliemopps · · Score: 4, Interesting

      Apple is using that same control to prevent you from scanning for viruses...

      http://www.forbes.com/sites/timworstall/2012/05/22/apple-wont-let-kaspersky-develop-tools-for-ios/

    2. Re:Apple's closed system by causality · · Score: 4, Insightful

      Why is it that there is no malware for IOS? There are millions of these devices out there, so there certainly is an incentive for malware writers.

      I believe that it has something to do with the fact that only Apple approved and checked software can be installed thereon. This closed system may not appeal to many here on /., but it is certainly as close as we have gotten to a malware proof computing experience we are likely to get anytime soon. Mac users will be able to enjoy this form of security with OS X 10.8 this summer.

      Many people need to play in the approved sandbox or else they'll stumble and hurt themselves. Others know what they're doing and understand the security implications of actions they take so they don't need Big Daddy Apple watching over them (and would in fact find that restrictive/suffocating).

      If you're willing to learn and attain your own understanding you will find that much more information than you would ever need is freely available. Then you achieve independence and freedom. You can then do what you like with equipment that's truly yours. If all of that is "too hard" and you prefer to use a machine for years without ever really grasping the principles behind it, then you are likely to be controlled by somebody: either a relatively benevolent vendor or a malware author. The former wants the money you choose to give to it; the latter will take everything it can.

      There isn't a One True Way. The only real mistake is to wrongly assume you are in a given category when you are not. For Joe Sixpack users who do not enjoy discovering and learning new things, the Apple method has a lot of advantages. If its widespread use makes it harder for criminals to make a profit, that benefits the rest of us as well.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    3. Re:Apple's closed system by Anonymous Coward · · Score: 2, Insightful

      There is absolute malware proof computing already: just don't install anything on your computer, disconnect it from network, in fact, just cut the power completely.

      Oh, and "there's no malware on AppStore" rather depends on your defintion of malware. Sending your contact list to a third party without questions was possible until a recent update. Just junkware and scams? Check. Just google for "pokemon yellow ios", for example.

      Yes, iOS malware can't spam SMS or hang in background, but on the other hand iOS apps can't send SMS or work in background.

      This security has quite a big tradeoff of censorship and dumbing down, so no, but thanks, no. Judging by market trends, general population seems to lean towards "free (as in freedom), but still has risks" side from "let us tell you what you want" side.

    4. Re:Apple's closed system by grantspassalan · · Score: 1

      So what, if there are no viruses, why does anybody have to scan for them? The only ones being harmed by Apple's business model of this closed system, are the developers of antivirus software. In the new OS X 10.8 OS, users who desperately want to install any software whatsoever, including a virus or Trojan, can still deliberately do so.

      --
      A sufficiently advanced simulation is indistinguishable from reality.
    5. Re: Apple's closed system by causality · · Score: 1

      unmod

      That works better when you don't post AC.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    6. Re: Apple's closed system by gmhowell · · Score: 1

      unmod

      That works better when you don't post AC.

      I haven't tested it, but I've read reports that while you do not get the warning if you post AC to a discussion in which you have posted, it will still remove said moderations.

      --
      Jesus was all right but his disciples were thick and ordinary. -John Lennon
    7. Re: Apple's closed system by causality · · Score: 1

      unmod

      That works better when you don't post AC.

      I haven't tested it, but I've read reports that while you do not get the warning if you post AC to a discussion in which you have posted, it will still remove said moderations.

      If so I believe that's a new thing.

      Also, regarding your sig... His disciples were definitely thick. They were not ordinary. They showed extraordinary courage. I mean... Peter was executed by crucifixion. His lament? He did not feel worthy to die by the same method as his Master. So according to legend, he was crucified ... upside-down. Ordinary people would have been like the "old Peter" who denied Him thrice.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    8. Re:Apple's closed system by __aaltlg1547 · · Score: 2, Insightful

      The level of access that an antivirus program needs is the level of access that a virus needs. Apple's not giving that to the would-be malware creators either.

      Besides, an antivirus program for iOS makes no sense because there aren't any such things to protect against. .

    9. Re:Apple's closed system by __aaltlg1547 · · Score: 3, Insightful

      Many people need to play in the approved sandbox or else they'll stumble and hurt themselves. Others know what they're doing and understand the security implications of actions they take so they don't need Big Daddy Apple watching over them (and would in fact find that restrictive/suffocating).

      No, not many. A few. The iPhone is a consumer device. Opening it up for anybody to program and distribute whatever software they want would be of no benefit to the vast majority of users, no benefit to Apple and no benefit to the wireless providers.

      If they opened it up, they'd actually be screwing over their customers and business partners. I can't imagine a compelling argument why they should do so.

    10. Re:Apple's closed system by Lussarn · · Score: 1

      I believe that it has something to do with the fact that only Apple approved and checked software can be installed thereon. This closed system may not appeal to many here on /., but it is certainly as close as we have gotten to a malware proof computing experience we are likely to get anytime soon. Mac users will be able to enjoy this form of security with OS X 10.8 this summer.

      It is obviously a security feature to have trusted sources for your programs, there is nothing new to this, Linux have used this for the last 15 years and I can't believe Linux was the first. You have to understand that Unix was created like 40 years ago, and there is nothing technically secure about it in todays world. This is the same for Linux, BSD, OSX, Android and IOS. Most security is bolted upon it but the fact is that it probably can't be totaly secured, it's not designed that way. Compare with a web browser or Java/Flash/NaCL which is secure by design. Yes, they have security holes but they can be fixed. Unix is "fixed" by having trusted sources, that's not a technical solution. The problem with Apples stance on this subject is that there source is the only source on the IOS platform, and they happen to use it for a lot more than security, like keeping the competition out. Yes, I know *nix isn't really secure, but I still want to be able to run certain programs (this is more important to me than outmost security), and I wan't to use a platform where competition is fair.

    11. Re:Apple's closed system by symbolset · · Score: 1

      Exactly. If you need Antivirus, you're doing it wrong.

      --
      Help stamp out iliturcy.
    12. Re:Apple's closed system by ediron2 · · Score: 1

      Ratfucker slashcode just ate my comment.

      Came here to call you a pedant and point out that some of us like iphones because we already have too many other avenues for puttering; sometimes it's nice just to have a phone. Ok, a phone plus games and twitter and gps and media and email and.... but I'm ok that my 4s is NOT where I focus my hackerly urges. I don't have time for all the projects queued up in my home office (or as my wife calls it, that "damn mountain of electronics"). Lost my orig. comment trying to grok why slashcode was ignoring my html tags (my ul's and li's didn't yield bullets!!!) so you don't get a list this time.

      I promise, it isn't fear or wanting Apple to be my mommy...

    13. Re:Apple's closed system by tlhIngan · · Score: 1

      Why is it that there is no malware for IOS? There are millions of these devices out there, so there certainly is an incentive for malware writers.

      I believe that it has something to do with the fact that only Apple approved and checked software can be installed thereon. This closed system may not appeal to many here on /., but it is certainly as close as we have gotten to a malware proof computing experience we are likely to get anytime soon. Mac users will be able to enjoy this form of security with OS X 10.8 this summer.

      Because there's accountability in the App Store. You see, to get an app in there, you have to pay $99 a year. Which means you need a valid billing account Sure malware can use a fake credit card, but when Apple gets a chargeback, they'll cancel the account and remove the app.

      Next, if there's really a bad app in there, boom, Apple removes all the developer's apps and closes their account. And with a valid billing address means Apple can hunt you down. Hell, if you want to accept money for apps Apple makes you jump through hoops.

      It's just like the Flashback trojan - making money is easy, but getting paid is actually quite hard.

      The other reason is iOS makes it quite hard - to send a text message requires user intervention - an app can't send a text message on its own unless it uses its own service. Ditto phone calls - you can call up the dialer, but it'll ask if you really wanted to dial that number.

      The only real way to get malware onto iOS without exposing a real identity is via jailbreaks and surreptitious installation that way. To which iOS isn't immune.

      An interesting Android hack popped up recently - due to the way smartphone data plans work, an Android app with "Internet Access" can hijack any TCP connection on the phone.

    14. Re:Apple's closed system by Deorus · · Score: 1

      Your train of thought crashed as soon as you failed to realize the difference between research and production. It is perfectly OK to research one platform while using another, there is absolutely nothing wrong with that. I have developed the Linux kernel in the past and that hasn't stopped me from turning into an Apple fag. My understanding of how operating systems work does not make me want to tinker them all, quite the opposite. I am perfectly fine when things just work, that is my goal as an engineer.

    15. Re:Apple's closed system by causality · · Score: 1

      Your train of thought crashed as soon as you failed to realize the difference between research and production. It is perfectly OK to research one platform while using another, there is absolutely nothing wrong with that. I have developed the Linux kernel in the past and that hasn't stopped me from turning into an Apple fag. My understanding of how operating systems work does not make me want to tinker them all, quite the opposite. I am perfectly fine when things just work, that is my goal as an engineer.

      I was talking about users who *need* a managed experience or else they get into trouble. *Need*. I think people replying to me didn't get that part and perhaps I should have made it more clear.

      Wanting one or finding it convenient is different. If you can do serious kernel development then you are more skilled than I am, and I definitely don't need a managed experience. Yours is a genuine preference. It is not a need. That isn't what I was talking about at all and doesn't fit anything I was saying. I just get tired sometimes of how low the standards are, how little people expect of themselves. If the masses benefit from something, that didn't happen because of them. I'd rather it did.

      Incidentally I wouldn't call you an "Apple fag" or any other kind of "fag". The way you articulate yourself is better than that.

      --
      It is a miracle that curiosity survives formal education. - Einstein
  5. I'm willing to bet by InspectorGadget1964 · · Score: 1

    It comes from One Microsoft way in Redmond?

  6. Not a new concept by Shoten · · Score: 1

    DARPA has a project going on this right now...it's called the "Cyber Genome" project. The idea is that you can perform a fair bit of attribution to the person/organization that wrote a piece of malware based on the characteristics of the code. It's true, as well...examination of Stuxnet, for example, made it clear that it was probably written by a highly organized team of diverse and very skilled individuals. And that's just looking at a single piece of malware; looking at things like Zeus has shown the progression of it, and even how malware can fork and develop along different lines. If you take it to the next step, the goal is to be able to predict the characteristics of an iteration before it's even written. Yeah, nobody said DARPA tries to solve easy problems :)

    --

    For your security, this post has been encrypted with ROT-13, twice.
  7. I know this is nitpicking, but.... by Johann+Lau · · Score: 2

    Notice how one makes sense, the other doesn't:

    Researchers Map Android Malware 'Genome'

    Researchers 'Map' Android Malware Genome

    1. Re:I know this is nitpicking, but.... by Johann+Lau · · Score: 1

      Oh, you mean you "fixed" that for "me"? Why "thank you" :)

  8. myCollege Project :) by dgharmon · · Score: 1

    How to get Android and Malware in the same article.

    --
    AccountKiller
  9. I was saved by Linux's lack of popularity? by dgharmon · · Score: 1

    "didn't stop files named like c:\playerhost.dll from ending up in my home directory, on Linux. I guess you can say that I was saved by Linux's lack of popularity on the desktop, nothing else".

    No, you couldn't say that, how playerhost.dll got onto your home directory was you saved it there. And even if it was a Linux executable you would still have to perform a numbr of steps to get it to run, as well as supply the root password.

    "You can claim that many of those vulnerabilities are gone now that Adobe has stopped developing Flash for Linux"

    That's news to me, ..

    'Download Adobe Flash Player
    Adobe Flash Player version 11.2.202.235
    Your system: Linux 32-bit, Firefox
    ` link

    --
    AccountKiller
    1. Re:I was saved by Linux's lack of popularity? by Deorus · · Score: 1

      No, you couldn't say that, how playerhost.dll got onto your home directory was you saved it there. And even if it was a Linux executable you would still have to perform a numbr of steps to get it to run, as well as supply the root password.

      No, I did not save it there, notice the name "c:\playerhost.dll", it was clearly saved by an exploit to the browser or a plugin running on it (most likely Flash). Also, where the hell does your idea that root is needed in order to run executables come from?

      Regarding Flash losing support on Linux, I may have been misconceived as I might have gotten it confused with Adobe AIR.