If 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
summary
Scans 30k–50k apks and finds ~6,000 malicious samples, using a mix of static analysis (dex2jar plus jd gui) and an enhanced dynamic system built from a modified TAndroid emulator with random clicker and physical devices. The public apk scan API fingerprints nothing but detects server‑side polymorphism, fake‑token interceptors, premium‑sms drainers and pervasive info leakage; ~8% overall are malicious, <2% use exploits, ~14% leak identifiers and 55% of dangerous permissions tie to leakage. Takedowns from stores occur within 24 hours.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 0:30Matias Madou
- 2:01Outline
- 3:03Mobile Malware
- 5:23Distribution
- 6:53Malware Analysis
- 8:20How to create an Android APK
- 9:18Behavior analysis
- 10:30Fingerprinting malware
- 12:09Hotspot Shield
- 13:46Monkey Jump
- 15:02APK Scan
- 16:17What is APK Scan
- 18:51Statistics
- 19:40User Uploads
- 21:52Top Malware
- 23:05Top 10 Permission Requests
- 23:38Dangerous Permissions
- 24:19Leaked Location
- 25:49Information Leakage
- 27:44Sandbox Permissions
- 28:10Conclusion
- 28:44Flashlight
- 29:18Permission Bingo
- 30:56FakeToken
- 31:16How does it work
- 32:44Sandbox detection
- 34:16Historical analysis
- 35:14Conclusions
- 36:13Future work
- 38:11Phone analysis
- 38:42Android or iOS
related talks
25mMobile App Security: Threat Landscape
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle
30m"Latest Android threats and their techniques"
30mReversing Mobile Malware
42mMUwS, PHA, vulnerabilities: A walk through on what not to do
32mHacking the Hackers’ Code: Inside Android Malware
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
33mWhen Attackers Go Mobile-First with AI