Trendmicro Security Award 2012 Final Presentation
•Download as KEY, PDF•
0 likes•21,285 views
Lectured at Trendmicro Security Award 2012 Final Round
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (16)
Similar to Trendmicro Security Award 2012 Final Presentation
Similar to Trendmicro Security Award 2012 Final Presentation (20)
More from Hiromu Yakura
More from Hiromu Yakura (14)
Recently uploaded
Recently uploaded (20)
Trendmicro Security Award 2012 Final Presentation
- 1. The new malware detection system with SEAndroid Hiromu Yakura <hiromu1996@gmail.com>
- 2. Self-Introduction • Hiromu Yakura • 15 yo. • Twitter: @hiromu1996
- 3. Self-Introduction • Japanese national certified security specialist • Youngest Record • competitive programmer • Asia and Pacific Informatics Olympiad • won a bronze medal
- 4. Self-Introduction • Linux Kernel Developer • Accepted some patches • Android Developer • Lectured about Android security • “What is SEAndroid?” • at Tokyo University
- 5. Background • An alarming increase in Android malware McAfee Threats Report: First Quarter 2012
- 6. Background • An alarming increase in Android malware Big threat McAfee Threats Report: First Quarter 2012
- 7. Background • Percentage of detected malware types F-Secure Mobile Threat Report 2012 Q1より
- 8. Background • Percentage of detected malware types F-Secure Mobile Threat Report 2012 Q1より
- 9. Background • Percentage of detected malware types F-Secure Mobile Threat Report 2012 Q1より
- 10. DroidKungFu • This application contains exploit code • CVE-2009-1185 • Linux kernel vulnerability • CVE-2010-EASY • Android vulnerability
- 11. DroidKungFu • After gain root access • Install other malware • without user permit • user can’t delete malware
- 12. Security Application • Usual Android security application • Can’t detect root access • Can’t remove DroidKungFu • Because of Android Sandbox
- 13. Security Application • All of them adopt signature-based system • Can’t detect Zero-day Attack • Can’t detect encrypted files
- 14. The new system • I propose a new system • Defend from Zero-day Attack • Defend from root exploit
- 15. The new system • System Overview Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 16. The new system • This system use SEAndroid and Jubatus Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 17. The new system • This system use Jubatus and SEAndroid • Jubatus is distributed learning system • SEAndroid is LSM(Linux Security Module)
- 18. Jubatus • Distributed processing framework • Streaming machine learning library • More excellent in real-time, distribution • than MapReduce, Hadoop
- 19. SEAndroid • SEAndroid • One of the popular LSM • Android version of SELinux • Developed by NSA
- 20. SEAndroid • Mandatory Access Control • Least privileges • Audit log
- 21. The new system • How to work Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 22. The new system • When application send commands Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 23. The new system • Judge whether command is valid with policy Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 24. The new system • If SEAndroid judges the command is valid Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 25. The new system • If SEAndroid judges the command is invalid Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 26. The new system • The command is record in Audit log Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 27. The new system • System send log to Jubatus Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 28. The new system • Jubatus judges the application isn’t malware Whitelisted Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 29. The new system • Jubatus judges the application is malware Application Policy SEAndroid Jubatus Log Linux Kernel Android Server
- 30. ~Demo~
- 31. Features • Behavioral detection system • Defend from Zero-day Attack • Any of existing product can’t defend
- 32. Features • Use SEAndroid(Linux Security Module) • Enable root access detection • Logging only security incident • Higher precision and Lighter • than syscall hooking
- 33. Features • Real-time machine learning • Study from user feedback • Become higher precision steadily • Jubatus is best suitable for this system
- 34. Issue • This system depends on SEAndroid • SEAndroid is built-in system of kernel • Vendors must install SEAndroid • No device support SEAndroid on the market
- 35. Solution • This system can use other LSM • With only changing log parser • There are devices supporting TOMOYO Linux • TOMOYO Linux is LSM • The devices are made by Fujitsu
- 36. Solution • Work on some of commercial devices • In several years, All device support LSM • Because LSM is essential for Android
- 37. Lastly • I want to • Improve Android security system • Decrease damage of Android malware
- 38. Thank you for listening
Editor's Notes
- I&#x2019;m going to talking about the new malware detection system with SEAndroid for Android.\n
- My name is Hiromu Yakura.\nI&#x2019;m 15 years old.\nMy twitter account is hiromu1996.\n
- I&#x2019;m a youngest Japanese national certified security specialist.\nI like competitive programming and\nI got bronze medal at Asia and Pacific Informatics Olympiad.\n
- And I&#x2019;m working for Linux Kernel and have accepted some patches.\nAlso I&#x2019;m an Android Developer.\nI have lectured about Android Security entitled &#x201C;What is SEAndroid?&#x201D; at Tokyo University.\n
- These years, number of Android malware is increasing explosively.\nThis is a chart of detected Android malware.\n
- It is clear that they are becoming a big threat in the Android market.\n
- This is a chart of detected malware types.\nLet&#x2019;s look at the lower right.\n
- \n
- This is DroidKungFu, it is only about 3 percent.\nBut I think it is the biggest threat because it gains root access.\n
- DroidKungFu has two exploit codes to gain root access.\nThe first one is using a vulnerability of Linux kernel.\nThe second one is using that of Android.\nIt execute them and gain root access.\n
- After gained root access, it install other malware without user permit.\nAnd user can&#x2019;t delete malware.\n
- You may think user can defend with Android security application.\nBut security applications can not detect and remove DroidKungFu.\nBecause security applications work under the Android Sandbox.\n
- Also, all of security applications are adopting signature-based scanning system.\nSo they can not detect Zero-day Attack and encrypted files.\n\n
- I propose a new Android security system.\nIt can defend from zero-day attack and root exploit.\n
- This is an overview of the proposal system.\n
- This system use SEAndroid and Jubatus.\n
- Jubatus is distributed machine learning system developed by Japanese companies.\nSEAndroid is Linux Security Module for Android.\n\n
- First, I want to explain about Jubatus.\nJubatus is distributed processing framework and streaming machine learning library.\nJubatus is more excellent in real-time and distribution than other system like MapReduce and Hadoop.\n
- Second, SEAndroid.\nSEAndroid is Android version of popular Linux Security System, SELinux.\nIt&#x2019;s developed by National Security Agency, United States of America. \n\n
- SEAndroid has 3 function.\nThe first one is Mandatory Access Control.\nThe second one is Least privileges.\nThe last one is Audit log.\nMy system use audit log for detection.\n
- Next, I want to explain how this system works.\n
- When application send commands to Android OS.\n\n
- SEAndroid judge the command is valid with security policy.\n\n
- If SEAndroid judges the command is valid, SEAndroid pass that to kernel.\n\n
- If SEAndroid judges the command is invalid, SEAndroid block that.\n\n
- And the command is record in Audit log.\n\n
- When audit log are updated, system send log to Jubatus.\nAnd Jubatus judge whether the application is malware or not from the log.\n
- If Jubatus judges the application is not malware, the application are added to whitelist.\nAnd SEAndroid pass all commands of the application.\n\n
- If Jubatus judges the application is malware, system notify to user.\nAnd system urge user to remove application.\n
- I want to show some demonstration.\n
- There is three features of this system.\nThe first one is adopting behavioral detection system. So this system can defend from Zero-day attack. Any of existing product can not defend from Zero-day Attack.\nThe second one is using Linux Security Module to enable root access detection.\n\n
- The second one is using Linux Security Module to enable root access detection.\nAnd SEAndroid record to audit log only security incident.\nThat&#x2019;s why, this system keep higher precision and lighter than hooking system calls.\n\n
- The last one is real-time machine learning.\nThe system study from user feedback and always become higher precision.\nJubatus is best sutable for this system than all other system.\n
- There is a few issue.\nThis system depends on SEAndroid.\nBut SEAndroid is built-in system of kernel.\nThat&#x2019;s why, in order to use SEAndroid, vendors must install by default.\n
- However, this system can use other Linux Security Module instead of SEAndroid.\nOnly changing log parser, this system can adopt another Linux Security Module.\nAnd there are devices supporting TOMOYO Linux, which is one of Linux Security Module.\nThe devices are made by Japanese company, Fujitsu and sold on Japanese Market.\n
- That&#x2019;s why, this system is already work on some of commercial devices.\nAnd I think all device will support Linux Security Module in several years.\nBecause Linux Security Module is essential to defend Android from malware.\n
- Lastly, I want to improve Android security system and decrease damage of Android malware with this system.\nThank you for listening.\n
- \n