Sweetening Android Lemon Markets: Measuring and Curbing Malware in Application Marketplaces

Abstract

Public reporting burden for the collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to a penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. AbstractApplication marketplaces are the main software distribution mechanism for modern mobile devices but are also emerging as a viable alternative to brick-and-mortar stores for personal computers. While most application marketplaces require applications to be cryptographically signed by their developers, in Android marketplaces, self-signed certificates are common, thereby offering very limited authentication properties. As a result, there have been reports of malware being distributed through application "repackaging." We provide a quantitative assessment of this phenomenon by collecting 41,057 applications from 194 alternative Android application markets in October 2011, in addition to a sample of 35,423 applications from the official Google Android Market. We observe that certain alternative markets almost exclusively distribute repackaged applications containing malware. To remedy this situation we propose a simple verification protocol, and discuss a proof-of-concept implementation, AppIntegrity. AppIntegrity strengthens the authentication properties offered in application marketplaces, thereby making it more difficult for miscreants to repackage apps, while presenting very little computational or communication overhead, and being deployable without requiring significant changes to the Android platform.

A Forensic Analysis of Android Malware -- How is Malware Written and How it Could Be Detected?

“…Vidas and Christin has investigated applications from alternative markets and compared them to applications from the official market [22]. They have found that certain alternative markets almost exclusively distribute repackaged applications containing malware.…”

Android Mobile Platform Security and Malware Survey

“…End-users get victimized because the applications are desirable to execute. Most users do not check if the application that they want to install does not have a replica [13]. And many fail to check the installation link was emailed to them.…”

“…The way to a secure App market is by performing a verification protocol that they proposed [13]. They called their method "AppIntegrity," which they claims a proof-of-concept implementation.…”

Evading android runtime analysis via sandbox detection

“…In particular, as miscreants discover that mobile devices can be targeted and exploited for financial gain, new forms of malware are created to do so. Some mobile malware is designed to work in tandem with PC-oriented malware while other focuses on mobile devices exclusively [18,36,40].…”