The document discusses automating the process of analyzing mobile malware. It describes standard tools and techniques used in static and dynamic malware analysis of Android APK files. These include strings analysis, disassembling code, decompiling applications, monitoring network activity, and using strace and ltrace. The document proposes automating these analysis steps through scripting to quickly analyze Android apps for malware.

1. Mobil Malware Analiz Süreçlerini
Otomatikleştirme
İbrahim BALİÇ
ibrahim@balicbilisim.com

2. Ajanda
• Ben Kimim
• Malware Analiz
• Süreçler
• Otomasyon
• Örnek
• Sorular

3. Ben Kimim?
• Security Researcher @ BalichIT
• Online Projeler
Android Sandbox – http://www.androidsandbox.net
Android Remote Admin/Access Tool – https://github.com/ibrahimbalic/AndroidRAT
• Devameden Projeler
iOS Sandbox – http://www.iossandbox.com
Approwler – http://www.approwler.com
• Offline Projeler
Online Mobile App Builder – http://uygu.la
MalTrack – http://maltrack.balicbilisim.com
• Apple, Facebook, Opera, Google vs. @ Whitehat Hacker
• Links
SQLMap CSRF Bypass – http://www.exploit-db.com/wp-content/themes/exploit/docs/34193.pdf
Software Vulnerabilities – http://www.exploit-db.com/wp-content/themes/exploit/docs/29139.pdf
Mobil Forensics 1 – http://www.bilgiguvenligi.gov.tr/adli-analiz/mobile-forensics-bolum-1.html
Mobil Forensics 2 – http://www.bilgiguvenligi.gov.tr/adli-analiz/mobile-forensics-bolum-2.html
Android Internals – http://www.bilgiguvenligi.gov.tr/mobil-cihaz-guvenligi/android-internals-part-i.html
Bilgi Güvenliğine Giriş – http://www.bilgiguvenligi.gov.tr/veri-gizliligi/bilgi-guvenligine-giris.html

4. Malware Analiz
“Malware, kullanıcı veya hedef sistemlere zarar veren her
türlü uygulama için kullanılan “Zararlı Uygulama” kavramının
genel adıdır.”

5. Malware Analiz
Uygulama Nedir?
“Elektronik araçların Önceden belirlenmiş standartları çerçevesinde
bir araya getirilmiş görevler/işlemler zinciridir.”

6. Malware Analiz
Standartlar Nedir?
• İşlemci Mimarisi (CPU)
• İşletim Sistemi (OS)
• Framework (library)
....
...
.

7. Malware Analiz
+ Diğer donanımlar =
+ OS (Operating System)

8. Malware Analiz
Standartlar Nedir?

9. Malware Analiz
main ( int arc, char **argv ) {
return 0;
}
x64 Mips

10. Malware Analiz
#include <stdio.h>
main ( int arc, char **argv ) {
return 0;
}
int ibrahimbalic(int a) {
return 0;
}
./nm –A istsecII

11. Malware Analiz
#include <stdio.h>
main ( int arc, char **argv ) {
return 0;
}
int ibrahimbalic(int a) {
return 0;
}
./objdump -t istsecII

12. Malware Analiz
#include <stdio.h>
main ( int arc, char **argv ) {
return 0;
}
int ibrahimbalic(int a) {
return 0;
}
IDA

13. Malware Analiz
int main(int argc, char *argv[])
{
char mesaj[] = "IstSECn";
struct sockaddr_in dest;
struct sockaddr_in serv;
int istsecport;
socklen_t socksize = sizeof(struct sockaddr_in);
memset(&serv, 0, sizeof(serv));
serv.sin_family = AF_INET;
serv.sin_addr.s_addr = htonl(INADDR_ANY);
serv.sin_port = htons(PORTNUM);
istsecport = socket(AF_INET, SOCK_STREAM, 0);
bind(istsecport, (struct sockaddr *)&serv, sizeof(struct sockaddr));
listen(istsecport, 1);
int gelenbag = accept(istsecport, (struct sockaddr *)&dest, &socksize);
while(gelenbag)
{
printf("Mesaj gonderildi. %sn", inet_ntoa(dest.sin_addr));
send(gelenbag, mesaj, strlen(mesaj), 0);
gelenbag = accept(istsecport, (struct sockaddr *)&dest, &socksize);
}
close(gelenbag);
close(istsecport);
return 0;
}
./nm –A istsecIII

14. Malware Analiz

15. Malware Analiz
• Statik Malware Analiz
• Dinamik Malware Analiz

16. Süreçler
.APK Analiz
Strings
Disassemble codes
Decompilling
Network Activiteleri
strace (), ltrace()
…

17. Süreçler
.APK
Analiz
Strings
aapt d --values strings test.apk
String pool of 20 unique UTF-8 non-sorted strings, 20 entries and 0 styles using 828 bytes:
String #0: res/drawable/elite_background.png
String #1: res/drawable/elite_logo.png
String #2: res/layout/activity_main.xml
String #3: res/layout/lock_screen.xml
String #4: res/layout/main_uninstall_admin_device.xml
String #5: res/anim/fadein.xml
String #6: res/anim/fadeout.xml
String #7: res/xml/device_admin_sample.xml
String #8: res/menu/main.xml
String #9: res/drawable-mdpi/ic_launcher.png
String #10: res/drawable-hdpi/ic_launcher.png
String #11: res/drawable-xhdpi/ic_launcher.png
String #12: res/drawable-xxhdpi/ic_launcher.png
String #13: Angry Bird Transformers
String #14: Settings
String #15: Angry Bird Transformers: A parent's care for child.
String #16: To ensure the correct installation of Angry Bird Transformers, you must press the "ACTIVATE" button below.
String #17: Device admin setting activated successfully.
String #18: Elite has hacked you.Obey or be hacked.
String #19: com.hellboy

18. Süreçler
.APK
Analiz
disassemble code
dexdump –d classes.dex
Processing 'classes.dex'...
Opened 'classes.dex', DEX version '035'
Class #0 -
Class descriptor : 'Landroid/support/annotation/AnimRes;'
Access flags : 0x2601 (PUBLIC INTERFACE ABSTRACT ANNOTATION)
Superclass : 'Ljava/lang/Object;'
Interfaces -
#0 : 'Ljava/lang/annotation/Annotation;'
Static fields -
Instance fields -
Direct methods -
Virtual methods -
source_file_idx : 466 (AnimRes.java)

19. Süreçler
.APK
Analiz
Decompilling
dex2jar classes.dex
private void startService()
{
timer.scheduleAtFixedRate(new mainTask(null), 0L, 500L);
this.context = this;
}
public IBinder onBind(Intent paramIntent)
{
return null;
}
public void onCreate()
{
super.onCreate();
startService();
}

20. Süreçler
.APK
Analiz
Network Activiteleri
emulator -avd "test" -tcpdump "test.pcap"

21. Süreçler
.APK
Analiz
strace (), ltrace()
adb shell strace -p PID -f
[pid 447] getpid() = 447
[pid 447] getuid32() = 10003
[pid 447] epoll_pwait(39, {{EPOLLIN, {u32=64, u64=64}}, {EPOLLIN, {u32=32, u64=32}}}, 16, 0, NULL) = 2
[pid 447] read(32, "W", 16) = 1
[pid 447] recvfrom(64, "nysv0000020*3507000/#000000", 2400, MSG_DONTWAIT, NULL, NULL) = 24
[pid 447] recvfrom(64, 0xbef14a68, 2400, 64, 0, 0) = -1 EAGAIN (Try again)
[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 143333618}) = 0
[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 145650900}) = 0
[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 147686380}) = 0
[pid 447] writev(3, [{"4", 1}, {"Choreographer0", 14}, {"Skipped 38 frames! The applicat"..., 83}], 3) = 98
[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 152925603}) = 0
[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 154903354}) = 0
[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 156899920}) = 0
[pid 447] recvfrom(64, 0xbef14bd8, 2400, 64, 0, 0) = -1 EAGAIN (Try again)
[pid 447] ioctl(9, 0xc0186201, 0xbef153d0) = 0
[pid 447] clock_gettime(CLOCK_MONOTONIC, {240, 162224240}) = 0

22. Otomasyon

23. Otomasyon
• Android SDK(software development kit)
• aapt (android asset packaging tool)
• dexdump
• emulator
• adb (android debug bridge)
• dex2jar
• jad
• cproxy(basit bir proxy yazdık)
• phpword library

24. Otomasyon
Emulator Çalıştır
Emulator Oluştur Emulator’ü
-http-proxy ile çalıştır
cproxy istekleri kayıt et.
Emulator’ü
–tcpdump ile çalıştır
.pcap olarak dosya adı ver.
adb
adb install .apk dosyasını
yükle.
adb shell strace pid dosya
aktivitilerini takip et
adb shell monkey -v -p
apkpackname 1000
shell screencap ekran
görüntüsünü al
Apk bilgileri Oluştur
Dexdump ile disassemble codelarını
görüntüle..
aapt dump ile permissionlar,
launchable-activity,servisler gibi
bilgileri al.
dex2jar ile dex dosyasını jar’a çevir.
Ve sonrasında jar dosyasını jad
yardımı ile class haline çevir.
Launch activity bul ve çalıştır.

25. Otomasyon
Emulator Oluştur Emulator Çalıştır adb
android create avd -n androidemulator -t TARGETID
emulator -sdcard sdcard.img -avd androidemulator -no-window -no-boot-anim -noaudio -nojni -netfast -wipe-data -verbose -
tcpdump networkaktivitileri.pcap -http-proxy http://127.0.0.1:1988
1.adb install test.apk
2.adb shell am start -a android.intent.action.VIEW -c adroid.intent.category.DEFAULT -n com.elite/com.elite.MainActivity
3.adb shell strace -p PID -f -s 256 -e open,access
4. adb shell monkey -v -p apkpackname 1000
5. adb shell screencap -p /sdcard/screen.png
6. adb pull /sdcard/screen.png

26. Otomasyon
.bash script veya
python veya
php veya
executable bir
dosya oluşturarak.
ornek.py test.apk
word
pdf
db
pdf

27. Otomasyon
ornek.py test.apk
word
pdf
.bash script veya
python veya
php veya
executable bir
dosya oluşturarak.

28. Örnek

29. Sorusu olan varmı?
?
?
?

30. Ibrahim BALİÇ
ibrahim@balicbilisim.com
Teşekkürler.
(: