#HITBLockdown002
Android malware analysis engine is not a new story. Every antivirus company has their own secrets to build it. With curiosity, we develop a malware scoring system from the perspective of Taiwan Criminal Law in an easy but solid way.
We have an order theory of criminal which explains stages of committing a crime. For example, crime of murder consists of five stages, they are determined, conspiracy, preparation, start and practice. The latter the stage the more we’re sure that the crime is practiced.
According to the above principle, we developed our order theory of android malware. We develop five stages to see if the malicious activity is being practiced. They are 1. Permission requested. 2. Native API call. 3. Certain combination of native API. 4. Calling sequence of native API. 5. APIs that handle the same register. We not only define malicious activities and their stages but also develop weights and thresholds for calculating the threat level of a malware.
Malware evolved with new techniques to gain difficulties for reverse engineering. Obfuscation is one of the most commonly used techniques. In this talk, we present a Dalvik bytecode loader with the order theory of android malware to neglect certain cases of obfuscation.
Our Dalvik bytecode loader consists of functionalities such as 1. Finding cross reference and calling sequence of the native API. 2. Tracing the bytecode register. The combination of these functionalities (yes, the order theory) not only can neglect obfuscation but also match perfectly to the design of our malware scoring system.
Further, we will also show a case study of Android malware and demonstrate how the obfuscation technique is useless to our engine. Last but not least, we will be open-sourcing everything (Malware Scoring System, Dalvik Bytecode Loader) during our presentation.
https://github.com/quark-engine/quark...
===
JunWei is a Security Researcher from Taiwan. A paranoid Pythonista who focuses on cybersecurity, reverse engineering, and malware analysis. And as a CPython contributor, PyCon Taiwan Program Committee, presented at HITB Armory, Europython, PyCon Taiwan, PyCon Korea, PyCon Malaysia. He’s the co-founder of Quark-Engine and a security research group, TWBGC.
---
KunYu Chen is a security researcher at Telecom Technology Center, Taiwan. Since 2014, he has been engaged in honeynet system research and the automation of malware analysis. Also, he’s an open source activism who contributes to CPython, viper-framework and the founder of Quark-Engine and a security research group, TWBGC. He presented at HITCON CMT 101, PyCon Korea, PyCon Taiwan and COSCUP.
---
IokJin is a security researcher and a core member of TWBGC, a security community in Taiwan. He also loves to analyze things in a deep dive way. His recent interest is 8 bits vintage computers and learning BASIC programming on it.
---
I’m a security engineer at TWBGC. Also, I’m a Pythonista, trying to do everything in pythonic.
---
Chung Hsin is a malware reverse engineer for Institute for Information Industry from Taiwan. He is very interested in finding new bugs in real world software products with fuzzing and reverse engineering. He also has a great passion for online game cheating and hacking techniques.