Harvester
Detects "dormant" malicious code in Android apps
Attackers are increasingly hiding "sleeper" malware in smartphone apps. This "sleeping" malware remains inactive at first. It only becomes active after hours or days, and some malicious apps only activate after the mobile device is restarted. This complicates and delays the detection of the malicious code. Fraunhofer SIT and the Technical University of Darmstadt have developed Harvester, a new tool that allows analysts to detect “sleeper” malware within a minute, even if the programmers have attempted to conceal the malicious code.
Harvester Saves Time
Millions of Android mobile devices are already infected with “sleeping” malware—which only becomes noticeable after a certain incubation period or specific actions on the smartphone. In hindsight, due to the malicious app’s long “dormancy period,” users find it difficult to determine the actual cause of unwanted ad banners or other undesirable actions. Sleeper apps also pose a problem for security analysts: They must examine hundreds to thousands of apps in a very short time and therefore cannot check all possible event combinations (time delay, reboot, calls longer than 10 seconds, etc.). Security experts at Fraunhofer SIT and the Technical University of Darmstadt have developed the Harvester tool to combat this type of malware. Harvester uses a unique new combination of static and dynamic code analysis and code transformation, thereby saving security analysts a great deal of time.
How exactly does Harvester work?
Harvester does not examine the original malware app, but rather a mini-version of the app that allows for easier identification of malicious behavior. To do this, Harvester uses a special static analysis technique (“backwards slicing” or “program slicing”). With this method, analysts can isolate suspicious sections from the code. Harvester then executes these (and only these) sections and checks what happens during execution. This allows the tool to bypass sections that would normally cause execution delays or similar issues. Harvester can then fully automatically extract important information (target phone numbers, SMS content, decryption keys, URLs, etc.) from the malicious Android code, which the analyst can use to determine the type and source of the malware. Harvester requires about one minute to perform a partial analysis of a code segment—this has been tested by experts at TU Darmstadt and Fraunhofer SIT on more than 13,500 common malware samples.
Harvester works even when the malicious app’s code is heavily obfuscated or other anti-analysis techniques have been used, as the tool is immune to currently common types of code obfuscation. A basic version of Harvester is available as an open-source tool for scientific purposes. For commercial use, companies can license a version with extended functionality.