Mobile Security Specialist
10y xp in IT area
Appsec & Mobsec
OWASP Mobile Security member
Focused in Android devices
Drums, chess, dogs, books, movies...
Slide 3
Slide 3 text
Malware is a term used for any type of malicious software designed to harm or
exploit any programmable device, service or network.
Slide 4
Slide 4 text
No content
Slide 5
Slide 5 text
No content
Slide 6
Slide 6 text
No content
Slide 7
Slide 7 text
No content
Slide 8
Slide 8 text
It runs a safety check on apps from the Google Play Store before you
download them.
It warns you about potentially harmful apps.
It may deactivate or remove harmful apps from your device.
It warns you about detected apps that violate Software Policy by hiding or
misrepresenting important information.
It sends privacy alerts about apps that can get user permissions to access
your personal information, violating our Developer Policy.
Slide 9
Slide 9 text
Limiting and checking App permissions;
Google Play Protect;
RASP (Runtime Application Self-Protection);
Code Obfuscation;
In House Solutions.
Set some action if a Malware is detected, ex: close the app
automatically.
Slide 10
Slide 10 text
Runtime permissions gives additional access to restricted data or let your app perform
restricted actions that affects the system and other apps. So, you need to request runtime
permissions before access the restricted data or perform restricted actions.
Slide 11
Slide 11 text
No content
Slide 12
Slide 12 text
No content
Slide 13
Slide 13 text
No content
Slide 14
Slide 14 text
The Accessibility system was developed for users with disabilities. Using it, you can
create an app that reads captions on all interface elements and enables you to
activate these elements with your voice. This became possible because Accessibility
grants you full access to the app interface in the form of a tree of elements: you can
navigate through it and perform certain operations with its elements.
Slide 15
Slide 15 text
By exploiting accessibility services, the Trojan can access the UI of any other
apps installed on the phone and steal data from them, including text.
Most banking apps don't allow the user to take screenshots when they're being used, but
some malwares like Svpeng, gets around this by using accessibility services to create
overlays and make actions in background.
Slide 16
Slide 16 text
Adding accessibility service to AndroidManifest.xml
Slide 17
Slide 17 text
Add the receiver to the AndroidManifest.xml
Slide 18
Slide 18 text
Adding this simple keylogger, all information entered by the user in any input
field of any app will be displayed in the console
Slide 19
Slide 19 text
In 2019, a vulnerability focused on the Android system emerged, which used the
system_alert_window permission, focused on PopUps, to overlay the screen with
a window over the apps.
Slide 20
Slide 20 text
No content
Slide 21
Slide 21 text
The focus of malware is precisely to trick the user into thinking
that the program is useful or beneficial to him in some way. But
in reality, the program performs actions that harm the user or
application to harm other applications or services. In this case,
using accessibility permissions to overlay the main screen and
change the data underneath that screen.
Slide 22
Slide 22 text
Desabilitar Google Play Protect
Habilitar downloads de fontes externas não oficiais
Utiliza o app principal para download do gerenciador de device
Desabilitam botão de desinstalar
Permissões Dangerous e SignatureorSystem
Slide 23
Slide 23 text
Slow performance;
Random reboots;
Unusually data usage;
Battery draining faster than usual;
Unfamiliar apps installed;
Overheating;
Taking a long time to shut down;
Signs of activity in standby mode;
Weird sounds during phone calls;
Weird text messages.
Slide 24
Slide 24 text
Thomas, Tony; Surendran, Roopak; John, Teenu S.; Alazab, Mamoun.
Intelligent Mobile Malware Detection (Security, Privacy, and Trust in
Mobile Communications). CRC Press. Kindle Edition.