Preface |
|
xi | |
Acknowledgments |
|
xiii | |
Authors |
|
xv | |
Conventions |
|
xix | |
|
Chapter 1 Introduction to the Android Operating System and Threats |
|
|
1 | (6) |
|
Android Development Tools |
|
|
2 | (1) |
|
|
3 | (2) |
|
Looking Closer at Android Apps |
|
|
5 | (2) |
|
Chapter 2 Malware Threats, Hoaxes, and Taxonomy |
|
|
7 | (28) |
|
|
7 | (3) |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
9 | (1) |
|
|
10 | (15) |
|
|
10 | (1) |
|
|
11 | (1) |
|
|
11 | (1) |
|
|
11 | (1) |
|
|
12 | (1) |
|
|
13 | (1) |
|
|
13 | (1) |
|
|
14 | (1) |
|
|
14 | (1) |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
18 | (1) |
|
|
19 | (1) |
|
|
19 | (1) |
|
|
19 | (1) |
|
|
20 | (1) |
|
|
20 | (1) |
|
|
21 | (1) |
|
|
21 | (1) |
|
|
22 | (1) |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
23 | (1) |
|
|
24 | (1) |
|
|
24 | (1) |
|
|
24 | (1) |
|
|
25 | (3) |
|
|
25 | (1) |
|
|
25 | (1) |
|
|
26 | (1) |
|
|
26 | (1) |
|
|
26 | (1) |
|
|
27 | (1) |
|
|
27 | (1) |
|
|
27 | (1) |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
28 | (4) |
|
|
28 | (1) |
|
|
29 | (1) |
|
|
29 | (1) |
|
|
29 | (1) |
|
|
30 | (1) |
|
|
30 | (1) |
|
|
31 | (1) |
|
|
31 | (1) |
|
|
32 | (3) |
|
|
32 | (1) |
|
|
32 | (1) |
|
|
33 | (1) |
|
|
33 | (2) |
|
Chapter 3 Open Source Tools |
|
|
35 | (16) |
|
Locating and Downloading Android Packages |
|
|
36 | (1) |
|
Vulnerability Research for Android OS |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
38 | (5) |
|
|
38 | (1) |
|
|
38 | (1) |
|
|
39 | (1) |
|
Keytool Key and Certificate Management Utility |
|
|
39 | (1) |
|
|
39 | (1) |
|
|
40 | (1) |
|
|
40 | (1) |
|
|
41 | (1) |
|
|
41 | (1) |
|
|
41 | (1) |
|
|
41 | (1) |
|
|
42 | (1) |
|
|
43 | (1) |
|
|
43 | (2) |
|
|
45 | (1) |
|
|
45 | (1) |
|
|
45 | (1) |
|
|
45 | (1) |
|
|
45 | (1) |
|
|
45 | (1) |
|
|
46 | (1) |
|
|
46 | (1) |
|
|
46 | (1) |
|
|
46 | (1) |
|
Traceview and Dmtracedump |
|
|
46 | (1) |
|
|
47 | (1) |
|
|
47 | (1) |
|
|
47 | (1) |
|
|
48 | (1) |
|
|
48 | (1) |
|
|
48 | (1) |
|
|
48 | (3) |
|
|
49 | (1) |
|
|
49 | (1) |
|
|
49 | (1) |
|
|
49 | (2) |
|
Chapter 4 Static Analysis |
|
|
51 | (20) |
|
Collections: Where to Find Apps for Analysis |
|
|
52 | (2) |
|
|
52 | (1) |
|
Marketplace Mirrors and Cache |
|
|
53 | (1) |
|
|
53 | (1) |
|
Advanced Internet Queries |
|
|
53 | (1) |
|
Private Groups and Rampart Research Inc. |
|
|
53 | (1) |
|
Android Malware Genome Project |
|
|
54 | (1) |
|
|
54 | (1) |
|
Cryptographic Hash Types and Queries |
|
|
55 | (1) |
|
|
56 | (6) |
|
Antivirus Scans and Aliases |
|
|
57 | (1) |
|
|
57 | (1) |
|
Common Elements of an Unpacked APK File |
|
|
57 | (1) |
|
|
58 | (1) |
|
|
59 | (1) |
|
|
60 | (1) |
|
Other Content of Interest within an APK |
|
|
61 | (1) |
|
|
62 | (1) |
|
|
62 | (1) |
|
|
62 | (1) |
|
|
63 | (8) |
|
Chapter 5 Android Malware Evolution |
|
|
71 | (6) |
|
Chapter 6 Android Malware Trends and Reversing Tactics |
|
|
77 | (14) |
|
Chapter 7 Behavioral Analysis |
|
|
91 | (38) |
|
Introduction to AVD and Eclipse |
|
|
91 | (1) |
|
Downloading and Installing the ADT Bundle |
|
|
92 | (1) |
|
The Software Development Kit Manager |
|
|
93 | (1) |
|
Choosing an Android Platform |
|
|
94 | (1) |
|
|
95 | (1) |
|
|
95 | (1) |
|
|
95 | (1) |
|
Configuring Emulated Devices within AVD |
|
|
96 | (3) |
|
Location of Emulator Files |
|
|
99 | (1) |
|
|
100 | (1) |
|
Runtime Images: User Data and SD Card |
|
|
100 | (1) |
|
|
100 | (1) |
|
Setting Up an Emulator for Testing |
|
|
101 | (1) |
|
Controlling Malicious Samples in an Emulated Environment |
|
|
102 | (1) |
|
Additional Networking in Emulators |
|
|
102 | (1) |
|
|
103 | (1) |
|
Using the Emulator Console |
|
|
103 | (1) |
|
Applications for Analysis |
|
|
104 | (1) |
|
Capabilities and Limitations of the Emulators |
|
|
105 | (1) |
|
Preserving Data and Settings on Emulators |
|
|
105 | (1) |
|
Setting Up a Physical Device for Testing |
|
|
106 | (2) |
|
Limitations and Capabilities of Physical Devices |
|
|
108 | (1) |
|
Network Architecture for Sniffing in a Physical Environment |
|
|
109 | (1) |
|
Applications for Analysis |
|
|
110 | (1) |
|
Installing Samples to Devices and Emulators |
|
|
111 | (1) |
|
Application Storage and Data Locations |
|
|
112 | (1) |
|
Getting Samples Off Devices |
|
|
112 | (1) |
|
The Eclipse DDMS Perspective |
|
|
113 | (1) |
|
|
113 | (4) |
|
|
116 | (1) |
|
|
116 | (1) |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
118 | (4) |
|
|
122 | (1) |
|
Application Tracing on a Physical Device |
|
|
122 | (2) |
|
|
124 | (2) |
|
|
126 | (2) |
|
Using Google Services Accounts |
|
|
126 | (1) |
|
|
126 | (1) |
|
Getting Apps from Google Play |
|
|
127 | (1) |
|
|
127 | (1) |
|
|
128 | (1) |
|
Chapter 8 Building Your Own Sandbox |
|
|
129 | (46) |
|
|
130 | (1) |
|
|
131 | (1) |
|
Working Terminology for an Android Sandbox |
|
|
131 | (4) |
|
Android Internals Overview |
|
|
131 | (1) |
|
|
132 | (1) |
|
|
133 | (1) |
|
|
133 | (1) |
|
|
134 | (1) |
|
|
135 | (4) |
|
|
139 | (5) |
|
|
144 | (1) |
|
Tools for Static Analysis |
|
|
144 | (1) |
|
|
144 | (8) |
|
|
146 | (1) |
|
|
147 | (1) |
|
|
148 | (1) |
|
|
148 | (1) |
|
Tools for Dynamic Analysis |
|
|
149 | (1) |
|
|
149 | (1) |
|
|
150 | (1) |
|
|
151 | (1) |
|
TraceDroid Analysis Platform |
|
|
151 | (1) |
|
|
152 | (1) |
|
Sandbox Lab (Codename AMA) |
|
|
152 | (23) |
|
|
153 | (1) |
|
|
154 | (1) |
|
|
154 | (4) |
|
|
158 | (4) |
|
|
162 | (2) |
|
Static Analysis of Uploaded Malware Samples |
|
|
164 | (4) |
|
Dynamic Analysis of Uploaded Malware Samples |
|
|
168 | (5) |
|
|
173 | (2) |
|
Chapter 9 Case Study Examples |
|
|
175 | (30) |
|
|
175 | (21) |
|
|
180 | (1) |
|
|
180 | (5) |
|
|
185 | (1) |
|
|
185 | (2) |
|
|
187 | (8) |
|
|
195 | (1) |
|
|
196 | (9) |
Bibliography |
|
205 | (4) |
Index |
|
209 | |