Researchers Beat Google's Bouncer

← Back to Stories (view on slashdot.org)

Researchers Beat Google's Bouncer

Posted by timothy on Friday July 27, 2012 @04:14AM from the sneak-in-the-back-way dept.

An anonymous reader writes "When earlier this year Google introduced Bouncer — an automated app scanning service that analyzes apps by running them on Google's cloud infrastructure and simulating how they will run on an Android device — it shared practically nothing about how it operates, in the hopes of making malicious app developers' scramble for a while to discover how to bypass it. As it turned out, several months later security researchers Jon Oberheide and Charlie Miller discovered — among other things — just what kind of virtual environment Bouncer uses (the QEMU processor emulator) and that all requests coming from Google came from a specific IP block, and made an app that was instructed to behave as a legitimate one every time it detected this specific virtual environment. Now two more researchers have effectively proved that Bouncer can be rather easily fooled into considering a malicious app harmless."

44 comments

Min score:

Reason:

Sort:

pretty easy to fix, though by Trepidity · 2012-07-27 04:18 · Score: 4, Insightful

It seems like they just found that the sandbox Google simulates the apps in is a little sloppy in its simulation (IP addresses are predictable), so it's easy to tell you're inside the sandbox. But they could fix that part pretty easily.
Was hoping for something more halting-problem-esque, since it's really difficult to "scan an app for malware" in general.

--
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
1. Re:pretty easy to fix, though by TheLink · 2012-07-27 04:44 · Score: 1
  
  Yeah it's harder than solving the halting problem. In theory the halting problem is impossible, but at least with the halting problem you are provided with the full accurate description of the program (the program and complete inputs).
  
  Whereas with the "is this malware" problem you're not.
  
  One workaround is sandboxing. From the "halting problem" perspective, sandboxing would be the like setting a time limit so that all programs will halt by a certain time.
  --
  
  Too many replies beneath your current threshold
2. Re:pretty easy to fix, though by Anonymous Coward · 2012-07-27 06:30 · Score: 0
  
  What I am surprised at is Google overlooking such a uniquely identifiable thing as an IP in a simulation.
  Oh well, at least it was found now. Let's hope that is all that can be identified inside of it.
3. Re:pretty easy to fix, though by sourcerror · 2012-07-27 22:31 · Score: 1
  
  I don't think searching for malware is equivalent to solving the halting problem. For e.g. for a game it's enough to check where it wants to write; if it wants to write outside of it's own directory than it raises red flags. Basically it's enough to analyse what kind of APIs it uses. (The OS sandbox should provide an API that jails your writes to a certain directory.)
Meh by oldhack · 2012-07-27 04:19 · Score: 2

I thought bunch of nerds gave a drubbing to a bouncer at Google-sponsored party. Must be the bad coffee.

--
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
1. Re:Meh by localman57 · 2012-07-27 04:23 · Score: 2, Funny
  
  I thought bunch of nerds gave a drubbing to a bouncer at Google-sponsored party.
  Just out of curiousity, when have a bunch of nerds -- ever -- given a drubbing to a bouncer? (Physical drubbings only please, chicken-shit revenge tactics don't count...)
2. Re:Meh by somersault · 2012-07-27 04:35 · Score: 2, Informative
  
  Not all nerds are weak. A guy in my CompSci course actually worked as a bouncer. Really nice guy too - not just someone who was out to beat people up. A bunch of drunken nerds could take a single bouncer if they actually had the motivation. Bouncers tend to have backup though.
  
  --
  which is totally what she said
3. Re:Meh by oldhack · 2012-07-27 05:01 · Score: 1
  
  That's why it would be a news, dumb-dumb.
  
  --
  Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
4. Re:Meh by SilentStaid · 2012-07-27 07:15 · Score: 1
  
  As the global telecom guru for a Fortune 500 I max my bench at 350 while weighing 170 and I've just recently got my squat to 505. Some people geek out over numbers in D&D and some geek out over what an extra 2g of glutamine will do in a post workout drink.
  
  Let's grow up, shall we? /rant
Community Relations by schitso · 2012-07-27 04:21 · Score: 5, Insightful

"Google was aware of and blessed the research, and has been apprised of its results so that it can make changes and better secure Google Play against malicious individuals."

"A renowned security researcher who claims he discovered a flaw in iOS was kicked out of Apple's iOS Developers program."

Just sayin'.
1. Re:Community Relations by Desler · 2012-07-27 04:29 · Score: 2
  
  Yes, because he didn't apprise Apple of the research beforehand. That makes a pretty big difference than having the company be aware you are doing the research and give its blessing.
2. Re:Community Relations by crmarvin42 · 2012-07-27 04:33 · Score: 3, Insightful
  
  My impression was that they kicked him out for submitting the app to the store (for customers to purchase), not for finding the vulnerability. I know it's a bit of splitting hairs, but I suspect no penalty would have occured had he limited his actions to telling apple about the problem. Still think it was a bad response though.
  
  If Apple wants to seriously engage the security community there ought to be a way for the researchers to submit proof of concept apps to the app store to see if their current review process can catch them (obviously the reviewers would need to be blinded as to the identity of the submitter). They could improve their review process, catch security issues, AND avoid the negative press of booting a developer like this.
  
  --
  Bureaucracy expands to meet the needs of the expanding bureaucracy.-Oscar Wilde
3. Re:Community Relations by BonzaiThePenguin · 2012-07-27 04:35 · Score: 2
  
  He was kicked out for knowingly creating and releasing malware that downloaded malicious code to take control of the user's device, not because he discovered a flaw in iOS. Just sayin'.
4. Re:Community Relations by swillden · 2012-07-27 05:27 · Score: 1
  
  My impression was that they kicked him out for submitting the app to the store (for customers to purchase), not for finding the vulnerability.
  As did the guys who were testing Bouncer. They put an SMS blocker app on the Google Play Store and repeatedly updated it, adding more malicious behavior each time.
  
  --
  Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
5. Re:Community Relations by Anonymous Coward · 2012-07-27 05:58 · Score: 1
  
  He was kicked out for making Apple look bad by allowing any security flaw ever to become public
6. Re:Community Relations by Anonymous Coward · 2012-07-27 06:30 · Score: 2, Informative
  
  Actually, he did. (Assuming we're talking about Charlie Miller). He did several times and was promptly ignored. I'm sure if you google it, you'll find that out real quick.
  Then he made an application that abused said bug silently to prove a point, since nobody was listening.
7. Re:Community Relations by Anonymous Coward · 2012-07-27 06:40 · Score: 0
  
  Actually, he did. (Assuming we're talking about Charlie Miller). He did several times and was promptly ignored. I'm sure if you google it, you'll find that out real quick.
  Then he made an application that abused said bug silently to prove a point, since nobody was listening.
  If you ask for permission to do something and get no response, do not be surprised when people treat you as not having had permission when you do it anyway.
That's what they want you to think by cellocgw · 2012-07-27 04:22 · Score: 0

Actually any malware that's "smart" enough to fool Bouncer is left alone while the NSA, FBI, and MPAA are alerted. Black helicopters full of hot women in black latex arrive...

--
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
1. Re:That's what they want you to think by Anonymous Coward · 2012-07-27 04:41 · Score: 0
  
  Hot women in black latext arrive?
  [cracks open Android dev kit, begins coding...] ...
  if ( isInGoogleIPAddressBlock(testIPAddr) == true ) { ...
  } ...
News Flash by thePowerOfGrayskull · 2012-07-27 04:28 · Score: 0

News Flash: Any automated security system can be beaten.
In further news, using technology to secure against technology is only as effective as the minds behind it.
Tune in at 11.
Require signed apps? by bhlowe · 2012-07-27 04:32 · Score: 1

Running unsigned apps on a smart phone is just plain stupid. Why not just require android apps to be signed by a revokable certificate.. Charge at least $100 to get the certificate.. and then reward the malware-free app developers with a credit of at least $100 to cover the certificate cost.
1. Re:Require signed apps? by h4rr4r · 2012-07-27 05:08 · Score: 1, Troll
  
  They already do that, unless the user decides to turn it off.
  Any other ideas you want to share that are already in use?
2. Re:Require signed apps? by stanlyb · 2012-07-27 05:37 · Score: 1
  
  Running signed apps will help you how from the corrupt government? You remember MS and some "safe" certificates used by some "safe" viruses???
3. Re:Require signed apps? by bhlowe · 2012-07-27 07:45 · Score: 1
  
  Yes, the gubmint will be able to sign code and spy on you. And your point? Required signing would certainly help with malware, as the cost to produce and maintain a fresh supply of certs will be costly and will allow instant removal from the phone. And with a certificate, you can learn more about an app vendor--see if they appear legit or shady.
4. Re:Require signed apps? by stanlyb · 2012-07-27 10:57 · Score: 1
  
  With malware i could fight. But with corrupt government i am helpless.
Re:LOL grammar nazis by Stormthirst · 2012-07-27 04:36 · Score: 0, Flamebait

Apparently spelling isn't your forte either. And I'm not even going to get started on how much of a racist piece of shit you are.
Why not mandatory open source? by Anonymous Coward · 2012-07-27 05:10 · Score: 0

If they want secure apps in their stores, why don't they just demand that app-salesmen provide the source so that everyone can inspect it? They have the clout to do it, and it's not like any phone apps are going to contain any super-secret algorithms that must be kept secret for economical reasons.
1. Re:Why not mandatory open source? by jekewa · 2012-07-27 07:06 · Score: 1
  
  Of course it's because of the slew of people wouldn't bother paying for apps they could build and install themselves. Or those who would take it for their own, fork it, make it better, make it worse...
  
  --
  End the FUD
Surprised??? by stanlyb · 2012-07-27 05:35 · Score: 0

Lets see what we have:
1. Inside Google - A bunch of college boys (no girls, as they are not smart enough for google), very, extremely good at solving entry interview quiz and questions, but extremely poor and incompetent at actually doing what they were hired to do, DEVELOPING.
2. Outside Google - A bunch of software developers, usually old, with a lot of experience, some of them even PhD, and who are actually DEVELOPING a software that google buys, because their bunch is so incompetent...
So to sumarize it:
SURPRISE. The guys outside always outwit the boys inside.
1. Re:Surprised??? by Anonymous Coward · 2012-07-27 10:21 · Score: 0
  
  What are you trying to say? Because, interestingly, your post neither qualifies as serious nor sarcastic.
2. Re:Surprised??? by stanlyb · 2012-07-27 10:59 · Score: 1
  
  That the researchers exploited some development decisions made by the stupid google's employees. Stupid, because it is pretty easy to avoid them. And why they did these stupid mistakes? I do believe that i did answer to that question.
In soviet russia... by Anonymous Coward · 2012-07-27 06:11 · Score: 0

Bounced googles you!
Hmmmmmmm.... by endus · 2012-07-27 06:53 · Score: 2

It's almost as though they're trying to achieve security by making information about their service very obscure. Has anyone ever tried this before?
Re:LOL grammar nazis by mcgrew · 2012-07-27 07:24 · Score: 2, Insightful

Please, STOP FEEDING THE FUCKING TROLLS!!! Ignore them For God's sake, don't quote them!!! Jesus, man, what the fuck is wrong with you? Anonymous troll is at -1 so you gave him a voice! Mods, please downmod every response to the troll, including mine but especially the parent's, who stupidly quoted the racist bullshit. Fucking trollbiters are often as bad as the fucking trolls.

--
Free Martian Whores!
This is the best approach to security... by Ghjnut · 2012-07-27 08:14 · Score: 1

Google was aware of and blessed the research, and has been apprised of its results so that it can make changes and better secure Google Play against malicious individuals.

--
MouseClass extends ScrollClass, which extends TabClass, which extends SidebarClass, which extends PowerClass, w
2 big mistakes by GameboyRMH · 2012-07-27 08:17 · Score: 1

1 - not using random proxies
2 - not going out of their way to make the VMs look like real machines. This is already a problem with PC viruses, many of them are designed not to infect a VM to slow analysis.

--
"When information is power, privacy is freedom" - Jah-Wren Ryel
it's another layer by Chirs · 2012-07-27 09:13 · Score: 1

As long as you know what you're doing, obscurity can work just fine as another layer of protection.
The problem is that most people choosing obscurity aren't secure to start with, so it's the *only* layer of protection.
"Bouncer" provably cannot win by chithanh · 2012-07-27 10:05 · Score: 2

The problem that Bouncer is trying to solve (telling whether an app is malicious or not) is otherwise known as program verification. Rice's theorem states that this is undecidable, not totally unlike the Y2K problem. It may even be highly undecidable, so even if Google had a hypercomputer at their disposal, Bouncer would still lose.

So if Google wants to keep malware out, Bouncer is fundamentally the wrong approach.
ROFLMAO by Anonymous Coward · 2012-07-27 11:54 · Score: 0

Pawned.