Researchers Beat Google's Bouncer

An anonymous reader writes "When earlier this year Google introduced Bouncer — an automated app scanning service that analyzes apps by running them on Google's cloud infrastructure and simulating how they will run on an Android device — it shared practically nothing about how it operates, in the hopes of making malicious app developers' scramble for a while to discover how to bypass it. As it turned out, several months later security researchers Jon Oberheide and Charlie Miller discovered — among other things — just what kind of virtual environment Bouncer uses (the QEMU processor emulator) and that all requests coming from Google came from a specific IP block, and made an app that was instructed to behave as a legitimate one every time it detected this specific virtual environment. Now two more researchers have effectively proved that Bouncer can be rather easily fooled into considering a malicious app harmless."

Comments

pretty easy to fix, though

[Trepidity]

It seems like they just found that the sandbox Google simulates the apps in is a little sloppy in its simulation (IP addresses are predictable), so it's easy to tell you're inside the sandbox. But they could fix that part pretty easily.

Was hoping for something more halting-problem-esque, since it's really difficult to "scan an app for malware" in general.

Re:pretty easy to fix, though

[TheLink]

Yeah it's harder than solving the halting problem. In theory the halting problem is impossible, but at least with the halting problem you are provided with the full accurate description of the program (the program and complete inputs).

Whereas with the "is this malware" problem you're not.

One workaround is sandboxing. From the "halting problem" perspective, sandboxing would be the like setting a time limit so that all programs will halt by a certain time.

Re:pretty easy to fix, though

[sourcerror]

I don't think searching for malware is equivalent to solving the halting problem. For e.g. for a game it's enough to check where it wants to write; if it wants to write outside of it's own directory than it raises red flags. Basically it's enough to analyse what kind of APIs it uses. (The OS sandbox should provide an API that jails your writes to a certain directory.)

Meh

[oldhack]

I thought bunch of nerds gave a drubbing to a bouncer at Google-sponsored party. Must be the bad coffee.

Re:Meh

[localman57]

I thought bunch of nerds gave a drubbing to a bouncer at Google-sponsored party.

Just out of curiousity, when have a bunch of nerds -- ever -- given a drubbing to a bouncer? (Physical drubbings only please, chicken-shit revenge tactics don't count...)

Re:Meh

[somersault]

Not all nerds are weak. A guy in my CompSci course actually worked as a bouncer. Really nice guy too - not just someone who was out to beat people up. A bunch of drunken nerds could take a single bouncer if they actually had the motivation. Bouncers tend to have backup though.

Re:Meh

[oldhack]

That's why it would be a news, dumb-dumb.

Re:Meh

[SilentStaid]

As the global telecom guru for a Fortune 500 I max my bench at 350 while weighing 170 and I've just recently got my squat to 505. Some people geek out over numbers in D&D and some geek out over what an extra 2g of glutamine will do in a post workout drink.

Let's grow up, shall we? /rant

Community Relations

[schitso]

"Google was aware of and blessed the research, and has been apprised of its results so that it can make changes and better secure Google Play against malicious individuals."

"A renowned security researcher who claims he discovered a flaw in iOS was kicked out of Apple's iOS Developers program."

Just sayin'.

Re:Community Relations

[Desler]

Yes, because he didn't apprise Apple of the research beforehand. That makes a pretty big difference than having the company be aware you are doing the research and give its blessing.

Re:Community Relations

[crmarvin42]

My impression was that they kicked him out for submitting the app to the store (for customers to purchase), not for finding the vulnerability. I know it's a bit of splitting hairs, but I suspect no penalty would have occured had he limited his actions to telling apple about the problem. Still think it was a bad response though.

If Apple wants to seriously engage the security community there ought to be a way for the researchers to submit proof of concept apps to the app store to see if their current review process can catch them (obviously the reviewers would need to be blinded as to the identity of the submitter). They could improve their review process, catch security issues, AND avoid the negative press of booting a developer like this.

Re:Community Relations

[BonzaiThePenguin]

He was kicked out for knowingly creating and releasing malware that downloaded malicious code to take control of the user's device, not because he discovered a flaw in iOS. Just sayin'.

Re:Community Relations

[swillden]

My impression was that they kicked him out for submitting the app to the store (for customers to purchase), not for finding the vulnerability.

As did the guys who were testing Bouncer. They put an SMS blocker app on the Google Play Store and repeatedly updated it, adding more malicious behavior each time.

Re:Community Relations

[Anonymous Coward]

He was kicked out for making Apple look bad by allowing any security flaw ever to become public

Re:Community Relations

[Anonymous Coward]

Actually, he did. (Assuming we're talking about Charlie Miller). He did several times and was promptly ignored. I'm sure if you google it, you'll find that out real quick.

Then he made an application that abused said bug silently to prove a point, since nobody was listening.

Require signed apps?

[bhlowe]

Running unsigned apps on a smart phone is just plain stupid. Why not just require android apps to be signed by a revokable certificate.. Charge at least $100 to get the certificate.. and then reward the malware-free app developers with a credit of at least $100 to cover the certificate cost.

Re:Require signed apps?

[h4rr4r]

They already do that, unless the user decides to turn it off.

Any other ideas you want to share that are already in use?

Re:Require signed apps?

[stanlyb]

Running signed apps will help you how from the corrupt government? You remember MS and some "safe" certificates used by some "safe" viruses???

Re:Require signed apps?

[bhlowe]

Yes, the gubmint will be able to sign code and spy on you. And your point? Required signing would certainly help with malware, as the cost to produce and maintain a fresh supply of certs will be costly and will allow instant removal from the phone. And with a certificate, you can learn more about an app vendor--see if they appear legit or shady.

Re:Require signed apps?

[stanlyb]

With malware i could fight. But with corrupt government i am helpless.

Hmmmmmmm....

[endus]

It's almost as though they're trying to achieve security by making information about their service very obscure. Has anyone ever tried this before?

Re:Why not mandatory open source?

[jekewa]

Of course it's because of the slew of people wouldn't bother paying for apps they could build and install themselves. Or those who would take it for their own, fork it, make it better, make it worse...

Re:LOL grammar nazis

[mcgrew]

Please, STOP FEEDING THE FUCKING TROLLS!!! Ignore them For God's sake, don't quote them!!! Jesus, man, what the fuck is wrong with you? Anonymous troll is at -1 so you gave him a voice! Mods, please downmod every response to the troll, including mine but especially the parent's, who stupidly quoted the racist bullshit. Fucking trollbiters are often as bad as the fucking trolls.

This is the best approach to security...

[Ghjnut]

Google was aware of and blessed the research, and has been apprised of its results so that it can make changes and better secure Google Play against malicious individuals.

2 big mistakes

[GameboyRMH]

1 - not using random proxies
2 - not going out of their way to make the VMs look like real machines. This is already a problem with PC viruses, many of them are designed not to infect a VM to slow analysis.

it's another layer

[Chirs]

As long as you know what you're doing, obscurity can work just fine as another layer of protection.

The problem is that most people choosing obscurity aren't secure to start with, so it's the *only* layer of protection.

"Bouncer" provably cannot win

[chithanh]

The problem that Bouncer is trying to solve (telling whether an app is malicious or not) is otherwise known as program verification. Rice's theorem states that this is undecidable, not totally unlike the Y2K problem. It may even be highly undecidable, so even if Google had a hypercomputer at their disposal, Bouncer would still lose.

So if Google wants to keep malware out, Bouncer is fundamentally the wrong approach.

Re:Surprised???

[stanlyb]

That the researchers exploited some development decisions made by the stupid google's employees. Stupid, because it is pretty easy to avoid them. And why they did these stupid mistakes? I do believe that i did answer to that question.