Android War of Finding Needle in Haystack - Best Practice of Hunting System for Android Exploit in the wild

No ratings

Presented at CODEBLUE2018@TOKYO 2018 by

Lilang Wu

Moony Lin

Todd Han

As we all know, Android system has been gaining much popularity in the current world. At the same time, more and more vulnerabilities and in the wild 0day/Nday attack [1] are found in mobile application store including Google play.What is worse, as one of the most important attack vector, the both the existing and newly emerging applications (*.apk) in Google Play is so huge that hunting Android APT with exploit is much like finding needle in haystack for security vendors such as TrendMicro.Hence, maybe the first time as view of security vendor, we would like to introduce our hunting system for Android exploit in the wild in and out with our best experience learned during the hunting practice, how we filter the potential 0day/Nday exploit samples among the huge database and how we identify the potential exploit in the static and dynamic analysis system with multiple technical tricks. And also we would expose the secret of how we hunt the ZNiu sample which is the first Android malware to exploit DirtyCOW vulnerability.