- Android Malware on the Rise (2012)
- It is now well-known that, for various reasons, Android has become the leading OS for smartphones with more than 50% of worldwide market share within only a few years. This fast growth rate also has an evil side. Android brought backdoors and trojans to the yet spared Linux world with growth rates of over 3000% and more than 13000 malicious applications. These malicious apps are only seldom obfuscated and very basic in their functionality. In this technical report, we give a short overview of the existing malware families and their main functionality. As an example, we present the results of reverse engineering two paradigmatic malware samples of the Bmaster and FakeRegSMS families. These samples were chosen because they try to implement the first very simple approaches of obfuscation and behavior hiding. We conclude with discussing the following questions: How do you get infected? What was the main goal for malware authors in recent malicious applications? Is real obfuscation coming to Android? And finally, how does the future of malware look like?
- Usability vs. Security: The Everlasting Trade-Off in the Context of Apple iOS Mobile Hotspots (2013)
- Passwords have to be secure and usable at the same time, a trade-off that is long known. There are many approaches to avoid this trade-off, e.g., to advice users on generating strong passwords and to reject user passwords that are weak. The same usability/security trade-off arises in scenarios where passwords are generated by machines but exchanged by humans, as is the case in pre-shared key (PSK) authentication. We investigate this trade-off by analyzing the PSK authentication method used by Apple iOS to set up a secure WPA2 connection when using an iPhone as a Wi-Fi mobile hotspot. We show that Apple iOS generates weak default passwords which makes the mobile hotspot feature of Apple iOS susceptible to brute force attacks on the WPA2 handshake. More precisely, we observed that the generation of default passwords is based on a word list, of which only 1.842 entries are taken into consideration. In addition, the process of selecting words from that word list is not random at all, resulting in a skewed frequency distribution and the possibility to compromise a hotspot connection in less than 50 seconds. Spot tests show that other mobile platforms are also affected by similar problems. We conclude that more care should be taken to create secure passwords even in PSK scenarios.
- DiOS: Dynamic Privacy Analysis of iOS Applications (2014)
- We present DiOS, a practical system to perform automated dynamic privacy analysis of iOS apps. DiOS provides a highly scalable and fully automated solution to schedule apps from the official Apple App Store for privacy analysis to iOS devices. While apps are automatically executed, user interaction is simulated using random and smart execution strategies, and sensitive API calls as well as network connections are tracked. We evaluated the system on 1,136 of the most popular free apps from the iOS App Store and found out that almost 20% of all investigated apps are tracking users' locations on every app start, one third of all accesses to users' address books are attributed to apps from the social network category and almost half of all apps are tracking users' app usage behavior by incorporating tracking and advertising libraries.
- Information Leakage behind the Curtain: Abusing Anti-EMI Features for Covert Communication (2016)
- We present a new class of covert channels which can be created by utilizing common hardware but that cannot be detected by such. Our idea is to abuse anti-EMI features of a processor to create a covert channel on the physical layer. Thus, the sender uses the invariants in how digital signals are encoded over analog channels to covertly transport information. This leaked data is present on the wire bound connections of the compromised device, but is also by definition present in the vicinity of the device and can be picked up by radio equipment. As the covert channel is present only on the physical layer, the data on all layers above, as well as the timing behavior on those layers is indistinguishable from uncompromised devices. We present two example implementations of such channels using RS-232 as the carrier and use a common oscilloscope to decode the resulting covert channel. Using this setup, we observed symbol rates of around 5 baud. We derive the theoretical upper bound of the covert channels bandwidth and discuss the factors by which it is influenced.