What did you pack in my app? a systematic analysis of commercial Android packers
What did you pack in my app? a systematic analysis of commercial Android packers
复制标题
DOI：
10.1145/3540250.3558969
复制
发表时间：
2022-11
期刊：
影响因子：
--
通讯作者：
Zikan Dong;Hongxuan Liu;Liu Wang;Xiapu Luo;Yao Guo;Guoai Xu;Xusheng Xiao;Haoyu Wang
中科院分区：
文献类型：
--
作者：
Zikan Dong;Hongxuan Liu;Liu Wang;Xiapu Luo;Yao Guo;Guoai Xu;Xusheng Xiao;Haoyu Wang
商业Android打包程序已被开发人员广泛使用，作为保护其应用程序不被篡改的一种方式。然而，应用程序打包器通常是由安全供应商开发的在线服务，并且打包的应用程序受到很好的保护。因此我们很难知道应用中究竟包含了什么内容，而且社区中也很少有研究系统地分析商业应用打包者的行为。在本文中，我们提出了PackDiff，一个动态分析系统来检查商业包装机的细粒度行为。PackDiff通过检测Android系统，记录Android应用程序的运行时行为（例如，Linux系统调用调用，Java API调用，Binder交互等），并对其进行进一步处理，以查明打包者引入的其他敏感行为。通过将PackDiff应用于由7个商业包装商保护的大约200个应用程序，我们观察到现有商业包装商令人失望的事实。大多数应用程序打包程序引入了不必要的行为（例如，访问敏感数据），严重的性能和兼容性问题，它们甚至可以被滥用来创建规避恶意软件和重新打包的应用程序，这与它们的设计目的相矛盾。
Commercial Android packers have been widely used by developers as a way to protect their apps from being tampered with. However, app packer is usually provided as an online service developed by security vendors, and the packed apps are well protected. It is thus hard to know what exactly is packed in the app, and few existing studies in the community have systematically analyzed the behaviors of commercial app packers. In this paper, we propose PackDiff, a dynamic analysis system to inspect the fine-grained behaviors of commercial packers. By instrumenting the Android system, PackDiff records the runtime behaviors of Android apps (e.g., Linux system call invocations, Java API calls, Binder interactions, etc.), which are further processed to pinpoint the additional sensitive behaviors introduced by packers. By applying PackDiff to roughly 200 apps protected by seven commercial packers, we observe the disappointing facts of existing commercial packers. Most app packers have introduced unnecessary behaviors (e.g., accessing sensitive data), serious performance and compatibility issues, and they can even be abused to create evasive malware and repackaged apps, which contradicts with their design purposes.