Today I want to warn you about a very common type of malware: Botnet. I will briefly explain how it works and how to avoid to be infected.
In the last years the spread of Android phones is increased significantly and with it the malicious user that want a monetary benefits or have political interests. Also the increase of computational power of the devices has contributed to this phenomenon.
A botnet is a network of infected device that are called bot in which the botmaster can send arbitrary command to be executed. The main differences between various botnets are the protocol used to send command from the botmaster to the bots.
In this section I'll show you all the type of control mechanism used by the botnets to control their infected devices.
The SMS protocol exploit the old and stable SMS system to exchange information between botmaster and botnets. In a SMS is codified a command that can be a plaintext or a ciphertext.
The HTTP protocol can be used in two ways:
The GCM protocol exploit the flexible and efficient Google Cloud Messaging to exploit the Android Notification System in order to send command completely silent from the perspective of the user.
In Android there is a permission based model that protect the sensitive information of the device, such as telephony, GPS, network, write and read file, access to the sms system etc.
When an application want to access to one of the sensitive information of the device the Android System mediate and control if the application has the permission to access to that resources [1].
The permission are encoded in a specific file called Manifest. At the time that user download the application, the system ask to the user to accept the permission of that application. If the user does not accept he cannot install the app.
In this way the decision to allow o not a resources to an application is demanded to the user.
The Android kernel is a variant of the Linux kernel and from it inherit the Linux Discretionary Access Control (DAC). At every app process is assigned a UID (unique id) and is placed in an isolated sandbox. The sandbox does not allow to the other app to access at the information of the app.[2]
If an app have a permission to one of the sensitive information of the precedent paragraph, at the app is assigned the GID (group id) of the specific information allowed to access.
Every app Android is signed with a specific key that identify a developer and his reputation. If two app have the same key, they have the same UID. In this way the app of the same developer can exchange the data.
To run the application a Google’s cloud infrastructure is used and the application is simulated to see how it will run on an Android device.
The app installed from the Google Play Store are analyzed by Bouncer [3]. This system is not perfect but it is a good filter for the malicious app [4]. It analyze all the application uploaded to the Google Play Store. It search for a known malicious behavior and analyze the application in order to found a similarity with a well-known malware, spyware or Trojans.
If the device is connected to internet and install an app from third party markets there is a mechanism to find a malicious behavior exploiting. In this case the Android system send to the server the signature of the app and determine if it is safe or not. [5]
My advise is DO NOT INSTALL an application outside the official Play Store. The platform offers you some simple, free and powerful tools to avoid that the smartphone will be infected and used in a botnet. That doesn't means that, if you install applications only from Play Store you are 100% safe but, if you install applications outside the Play Store you are almost certain that you will be infected.
[1] W. Enck, M. Ongtang, and P. Mc-Daniel "Understanding android security". IEEE Security Privacy, vol. 7, no. 1, pp. 50-57, Jan./Feb. 2009. [Online]. Available: http://dx.doi.org/10.1109/MSP.2009.26.
[2] "Android Security Overview". (Online; Last Accessed Nov. 15, 2015). [Online]. Available: https://source.android.com/security/.
[3] Google Bouncer "A Look at Google Bouncer". (Online; Last accessed Nov. 15, 2015). [Online]. Available: http://blog.trendmicro.com/trendlabssecurity-intelligence/a-look-at-googlebouncer/.
[4] J. Oberhide "Dissecting the Android Bouncer". (Online; Last Accessed Nov. 15, 2015). [Online]. Available: http://jon.oberheide.org/blog/2012/06/21/dissectingthe-android-bouncer/.
[5] Florence Ion "Are third-party security apps still necessary with Android 4.2?". (Online; Last Accessed Nov. 15, 2015). [Online]. Available: http://arstechnica.com/gadgets/2012/11/arethird-party-security-apps-still-necessarywith-android-4-2/.
