New Free Tools Simplify Analysis Of Android Malware
The Honeynet Project has helped create two tools aimed at making Android malware analysis simpler and free — and, ultimately, help better secure the wildly popular mobile platform.
The new open-source tools were developed under the Google Summer of Code project, a program where students from around the world spend their summer breaks writing code for open-source software. Two students under the mentorship of The Honeynet Project focused on Android malware: One wrote a static analysis tool called APKInspector, and the other, a dynamic analysis system called DroidBox — both of which are aimed at giving researchers a way to easily reverse-engineer Android malware and to observe and dissect malicious Android apps.
“These two tools nicely complement each other and should really be part of one’s toolbox [who deals] with mobile malware,” says Christian Seifert, chief communications officer for The Honeynet Project. “We believe that mobile malware will flourish, and while similar to malware on the PC, [it has] some unique characteristics that will reflect themselves in unique characteristics of the malware itself.”
For one thing, mobile malware can be written to access interfaces on the victim’s smartphone that are financially motivated, such as sending premium SMS messages, he says. “There are also some unique challenges in the mobile malware space. It’s a very new technology that security researchers are unfamiliar with,” and malware analysis is currently resource-intensive, he says.
The Android is a marked mobile platform both for its widespread popularity and its inherent open-source architecture and heritage: It’s already being inundated with rogue mobile apps and a plethora of research demonstrating its security and privacy weaknesses.
The Honeynet Project’s Ryan Smith, who served as a mentor for APKInspector author and graduate student Cong Zheng, says the new tools fill large gaps in Android attack analysis. The IDA Pro product
