Harvesting Runtime Values in Android Applications That Feature Anti-Analysis Techniques

Abstract

It is generally challenging to tell apart malware from benign applications. To make this decision, human analysts are frequently interested in runtime values: targets of reflective method calls, URLs to which data is sent, target telephone numbers of SMS messages, and many more. However, obfuscation and string encryption, used by malware as well as goodware, often not only render human inspections, but also static analyses ineffective. In addition, malware frequently tricks dynamic analyses by detecting the execution environment emulated by the analysis tool and then refraining from malicious behavior. In this work we therefore present HARVESTER, an approach to fully automatically extract runtime values from Android applications. HARVESTER is designed to extract values even from highly obfuscated state-of-the-art malware samples that obfuscate method calls using reflection, hide sensitive values in native code, load code dynamically and apply anti-analysis techniques. The approach combines program slicing with code generation and dynamic execution. Experiments on 16,799 current malware samples show that HARVESTER fully automatically extracts many sensitive values, with perfect precision. The process usually takes less than three minutes and does not require human interaction. In particular, it goes without simulating UI inputs. Two case studies further show that by integrating the extracted values back into the app, HARVESTER can increase the recall of existing static and dynamic analysis tools such as FlowDroid and TaintDroid. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Challenges for Static Analysis of Java Reflection - Literature Review and Empirical Study

“…Harvester [74] combines static and dynamic analyses to combat malware obfuscation. Resolution of reflective calls is done by the dynamic analysis.…”

GreatEatlon: Fast, Static Detection of Mobile Ransomware

“…Runtime values extraction Harvester [32] is a new system intended to dynamically extract runtime values. Since it is based on a cyclical combination of slicing and code execution, it can extract values regardless of any possible encryption, obfuscation or other anti-analysis techniques applied to them.…”

Parameter Values of Android APIs: A Preliminary Study on 100,000 Apps

“…As indicated by [11], some sensitive runtime data (or parameter values of API methods) in Android apps can actually be used for identifying malicious apps. Indeed, as shown in Section III-C, many sensitive parameter values are actually used in many samples, making them good candidates for blacklisting.…”

“…One of the most sophisticated ones is Harvester [11], which is dedicated to extract runtime values from any position in the Android code. Although it is not the focus, Harvester could be also leveraged to extract the parameter values from all the Android API methods in Android apps.…”

“…A recent study with the Harvester [11] approach has demonstrated that sensitive runtime data from Android apps can be used to identify malware. With the Bouncer, Google Play's maintainers are already leveraging runtime data to filter out those apps that violate the store's policy (e.g., sending SMS to their blacklisted phone numbers).…”