CRII: SaTC: A Malware-Inspired Approach to Mobile Application Repackaging and Tampering Detection

移动的应用程序（“app”）重新包装对蓬勃发展的移动的市场和众多用户是严重威胁。97%的顶级付费Android应用程序和87%的iOS应用程序已经重新打包。此外，它是传播移动的恶意软件的最常见方式之一。现有的对策主要基于应用相似性测量来检测重新打包，当混淆应用于重新打包的应用时，这往往是不精确的。此外，它们依赖于一个集中的方，通常是托管应用程序商店，来执行检测，但许多替代应用程序商店未能对盗版检测做出适当的努力。这项研究旨在有效防御应用程序重新打包，并将在解决通过重新打包的应用程序传播的恶意软件方面取得实质性进展。它将有助于缓解从重新打包的应用程序发起的勒索软件或DDoS等攻击。它还将有助于减少合法应用程序开发人员的巨额资金损失。工业合作确保将科学发现和技术知识迅速转化为有益的商业产品。该项目的教育资源，包括关于移动的安全和恶意软件检测的课程单元，将通过一个专门网站传播。这项研究将促进南卡罗来纳州大学新的研究和教育机会。本研究旨在探索一种去中心化的方案，将重新打包的检测能力添加到要保护的应用程序中，以便在应用程序运行时利用主机设备进行检测。主要的挑战是如何保护重新包装检测代码免受攻击。研究团队提出了一种新的恶意软件启发的方法来处理重要的移动的应用程序重新打包问题。该团队将探索逻辑炸弹的创造性使用，这是恶意软件中经常使用的：触发条件被构造为利用攻击者和用户之间的差异（在硬件，传感器值和输入方面），这样一个在攻击者端休眠的炸弹将在用户端被激活。只有在炸弹被激活时，才执行重新包装检测代码，该代码被包装为炸弹有效载荷。(2)与试图隐藏检测代码的许多传统软件篡改检测技术不同，通过利用恶意软件中使用的各种方法，这种设计是非隐形的，这意味着检测代码没有隐藏，但仍然对攻击有弹性。(3)所提出的系统还旨在检测代码篡改，这发生在插入恶意代码时，因此意味着非常危险。(4)分散的重新包装/篡改检测被提议用于众包恶意软件信息收集以对抗恶意软件传播。(5)最后，该团队将解决如何防止恶意软件作者滥用拟议的技术。该奖项反映了NSF的法定使命，并已被认为是值得通过使用基金会的智力价值和更广泛的影响审查标准进行评估的支持。

Mobile application ("app") repackaging is a severe threat to the flourishing mobile market and numerous users. 97% of the top paid Android apps and 87% of the iOS ones have been repackaged. Besides, it is one of the most common ways of propagating mobile malware. Existing countermeasures mostly detect repackaging based on app similarity measurement, which tends to be imprecise when obfuscations are applied to repackaged apps. Moreover, they rely on a centralized party, typically the hosting app store, to perform the detection, but many alternative app stores fail to commit proper effort to piracy detection. This research aims at an effective defense against app repackaging, and will result in substantial progress in tackling malware propagated via repackaged apps. It will help mitigate attacks such as ransomware or DDoS launched from repackaged apps. It will also help reduce the massive monetary loss of legitimate app developers. Industrial collaborations ensure rapidly translate scientific discovery and technical knowledge into beneficial commercial products. Educational resources from this project, including course modules on mobile security and malware detection, will be disseminated through a dedicated web site. This research will foster new research and education opportunities at University of South Carolina. Students from underrepresented groups will participate in the project.This research is to explore a decentralized scheme that adds repackaging detection capability into the app to be protected, such that the host devices are made use of to conduct detection when the app is running. The main challenge is how to protect the repackaging detection code from attacks. The team of research proposes a novel malware-inspired approach to handling the important mobile app repackaging problem. The team will explore a creative use of logic bombs, which are regularly used in malware: the trigger conditions are constructed to exploit the differences between the attacker and users (in terms of hardware, sensor values, and inputs), such that a bomb that lies dormant on the attacker side will be activated on the user side. The repackaging detection code, which is packed as the bomb payload, is executed only if the bomb is activated. (2) Unlike many conventional software tampering detection techniques that try to conceal the detection code, by leveraging various methods used in malware this design is non-stealthy, which means that the detection code is not hidden, yet still resilient to attacks. (3) The proposed system also aims to detect code tampering, which occurs when malicious code is inserted and hence implies extraordinary dangers. (4) The decentralized repackaging/tampering detection is proposed to be used for crowdsourced malware information collection to fight against malware propagation. (5) Finally, the team is to address how to prevent the proposed techniques from being abused by malware authors.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.