A Novel Runtime Technique For Identifying Malicious Applications
summary
Proposes identifying Android malware by scanning a process heap at runtime to find instantiated objects (no APK access required), uses Frida-based object carving to detect DexClassLoader instances and java.net sockets, demonstrates PoC on an infected Twitter app and YouTube showing injected JARs and live connections, hooks Runtime.exec to reveal shell commands, integrates with Android Attestation via a D‑Bus over TCP client library so apps can query results on-device. Works as a prototype but needs Frida/gadget or system-level privileges and raises new attack-surface and timeliness limitations.
AI-written summary · about
chapters (12)
- 0:00Introduction and background
- 3:15Android malware detection challenges
- 10:39Problem with current detection methods
- 14:16Runtime object analysis idea
- 17:48Demonstration of infected app
- 23:33Runtime analysis vs static analysis
- 27:43Frida for object carving
- 33:02Detecting malware from Android device
- 37:14Developing Y8K library
- 41:30Limitations and risks of approach
- 42:55Conclusion and future directions
- 43:59Q&A session
related talks
53mAndroid: He protec, but he also attac
38mAdvanced Techniques for Protecting Android Apps
47mAttacking Android Applications
53mHiding Behind Android Runtime (ART)
32mMalton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART
43mAttacking Android Applications
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
01h 07mHow to attack (and secure) an Android app: an introduction