my name is dimitrios and I'm engaged in
computer security since
2002 the last couple of years I focused
on Android security and uh about a year
ago I joined the Microsoft Defender
research team as senior security
researcher
and I'm here to talk to you about how I
enjoy the application can drain your
wallet and the reason that I choose this
category is due to the fact that it has
a very unique and very interesting flow
from a researchers point of view
so before I go to the details on how
this malware actually works let me first
go through some definitions so that
we're going to use in the next few
slides and let me first explain what is
billing fraud so by billing fraud we
refer to the uh malware category which
contains code that can charge the user
in an intentionally deceptive way
and we have a couple of subcategories of
building flow we have SMS Road call
fraud and Dolph road with the last one
being the most interesting one and the
one that we're going to focus in this
presentation
so when it comes to toll roads we're
talking about the Marvel family with the
multimedia billion dollar yearly
estimated revenue and one of the most
prevalented malware Android malware
categories according to the Google place
transparency report
uh it is also very popular I'm sure that
most of you have heard about the Joker
family
and this is due to the fact that it has
um it uses the Google Play Store as main
distribution mean
uh another thing that I want to talk to
you about is uh the WAP billing
mechanism so what is a web building
mechanism it is a billing mechanism
which uses the wireless application
protocol in order to enable to let the
users purchase Services products online
and get charged directly in their phone
bill
so here on the right side they have an
example of such a service which uses
this uh mechanism so you see there are
only customers are eligible for
subscriber benefits and when we're
talking about customers we're talking
about users which are using a specific
Sim operator another thing
is that the customers can subscribe to a
specific service by navigating to a web
enabled website then they're going to
receive an SMS which is going to inform
about the billing turbo the next billing
date and this type of info
and finally uh the customers cannot
subscribe to more than one service
subscription package at the time
so let me summarize the steps so you
have an idea of what is the help of the
overall process so first of all the user
has to navigate to a web enabled website
and by the time that the server is going
to receive this request you're going to
send back a subscription page so this
subscription page usually contains a
subscription button so the user has to
click
and by the time that the server is going
to receive this request a new request
you're going to send back a pin and OTP
so
this is done either using as an SMS or
the HTTP protocol or even the ussd
protocol in some rare cases and uh the
user has to send back the screen to the
server the server will receive the
screen will verify it and finally send
the SMS that I showed you in the
previous slide which
informs about the billing date and all
this kind of information now please note
that the steps four to six are not
always there and depend on
each implementation of the service
provider
so what is now a fraudulent subscription
so by fraudulent we refer to a
subscription which takes place without
the user's consent without the user
interaction and actually without even
being noticeable to the user so the
malware has to perform all these steps
that you see here in order to achieve
this type of subscription so it has to
make sure first of all that the device
is operating in a mobile network
uh so and this is done by either wait
for the user to switch the mobile
network or Force the device with a
mobile network then uh navigate to the
subscription page simulate the user's
click on the subscription page
in the set the pin which is sent from
the server
send this uh pin back to the server and
finally keep all this process silent in
order not to be noticeable to the user
so let's see how these things are taking
place now from the malware side and
before everything starts before this
steps start what one one critical
information that the malware has to
retrieve is the Sim operator so which
on which Sim operator the device is
registered so this type of formation can
be retrieved from a device by using the
mccrm and C codes and uh the specific
API calls which I depict here so either
using it again get some operator API
call of the telephone manager or the
system uh the get method of the system
properties class
uh with the difference between the two
of them that the one can be invoked
directly because by simply importing
this specific class while the second one
uh has to be loaded using reflection
because it's a marked the system API now
on the Lower Side they have an actual
code of uh one of the latest Joker
payloads which as you see it checks if
this information that retrieves from the
device starts with 655 so this one
actually belongs to the South Africa Sim
operator so if it starts with this six
by five it will proceed to the next
steps
and the next step is to make sure that
the device operates on a mobile network
and how this is done so wait for the
user to switch the mobile network so uh
create a connectivity manager instance
then from this perform this API call and
get the network information out of there
see if the device is connected using a
mobile network and go to the next step
or the other way is to force the device
to switch to a mobile network and how
this is done
so before SDK 29
uh there was a method there which is
called said Wi-Fi enabled and allows an
application to disable the Wi-Fi so this
uh doing this the device will switch
automatically to a mobile network
and this as I said was uh before SDK 29
because in SDK 29 and after we saw a new
technique
so use uh the network request Builder
and Define some specific capabilities
there then use the connectivity manager
in order to request this network and
finally buy the process to the network
and as before I have an example of this
technique on the right side
uh the demo code which is more easy to
understand so create this network
request Builder
defined the capabilities that we need we
actually want they actually want the
device to be able to connect to the
internet and use mobile connectivity
and finally uh request this network from
the connectivity manager
when this network is already buying the
approach to the network so with this in
this way we just they just make sure
that the device operates on a mobile
network
so now the next step is to get offers
to know where exactly to navigate and
this is done by communicating with the
command control server the communication
of course is either encrypted or some
they use some kind of encoding or even a
gun zip and
here again on the right side you can see
that the malware communicates with the
command control server receives a Json
object which has some URL some offers
and one of these offers may lead to a
redirection chain which will finally end
up on the landing page so this landing
page is a page which has the button that
I described before it's going to be
loaded in a webview which is not going
to be visible to the user so so far the
process remains silent the user can see
anything
so now a very important uh operating
system uh Android operating system
component which this malware uses is an
uh an Android OS Handler so what this
Handler does
is getting info about the current
um stage of the subscription process and
acts according to the stage so when the
page is finished loading or when SMS is
received the Handler is going to receive
a message and then it's going to act
somehow so here's an actual code which
shows exactly that receives this message
depending on the uh what parameter of
this message is going to perform some
kind of an action
and uh
one critical point one critical phase
of this process is when this page the
blending page has been loaded so what
has to happen right now is that the user
has to click on the subscription button
and this is done by using JavaScript so
the uh
Android OS Hunter will inject code which
is similar to this one that you see here
it does exactly it does something like
the following so it will scrub the page
and search for uh Elements which are
clickable
and they are relevant to the
subscription process for example they
are tagged like uh confirm yes click
enter subscribe
and all these elements are going to be
sent to a function which is called see
that as you see there
and this function is going to act in two
steps
so the first step is to call another
function which is called jdh and this
function will do the following we'll
check
if a cookie has been set if a specific
cookie has been set so if this cookie
cookie has been said then it's going to
set back false
if this cookie hasn't been said then
it's going to set this cookie and it's
going to set back true now what this
cookie is doing it's actually marking
the page so which means that we have the
malware has already subscribed the user
to the service the user cannot subscribe
to the same service more than monster
one time so ignore this page and move to
the next next one and exactly that's
what uh the initial function will do
we'll either submit click or it will
just pass the specific element and go to
the next page the next offer
uh
so we have
seen how it uh clicks now on the
subscription button what is next next as
I said before the server will send back
a pin we'll send back another p and this
OTP has to be
raised by the user and sent back to the
server so how the malware does that
either using an SMS broadcast receiver
or binding the notification listener
service
or using SMS content Observer now the
logic between all these techniques is
about the same
so using the first technique just
declare the required permissions in
order to do that
create a class which extends the
broadcast receiver and in the receive
callback check the body of the message
if it contains a specific keyword then
extract uh what is after I mean the PIN
and submit it back to the server now the
submission can be either in the same
page using HTTP protocol or even using
an SMS for example using the send SMS
text message
the other way is uh by extending
notification listener service and again
the logic is the same like I said is
about the same but the implementation is
different create a class which extends
notification listener service
and in the notification posted callback
just check the body of the notification
if it contains specific keyword extract
the message and send it back to uh
to the service provider
finally another way is by using content
Observer which what the Contour Observer
does is receiving callbacks for changes
to specific content
what we care about what malware cares
about here is about the SMS content so
if some changes happen there you're
going to get a triggered don't change
the unchanged callback there and will
perform exactly the same steps which is
uh check if there is a specific keyword
and send the pin back to the server
uh last but not least keep everything
silent so all this process that you saw
so far has to be not noticeable to the
user so since SDK 18 a an application
which extends the notification listener
service can cancel the notifications of
other apps what that means what this
means is that uh the SMS your SMS
application can simply cancel be
canceled notification that will be
receiving your device can simply be
canceled but by an application which
extends this specific uh service
and this can be done by using one of
these API calls for example cancel all
notifications to cancel all the
notifications so a specific one using a
specific key or another an array of
notification using an array of keys
another way of doing that is is by using
the abort broadcast in the broadcast
receiver implementation that I showed
you before
all right so let me summarize what we
have so far all the steps that we have
so far
so we said we have a WAP building
mechanism which can be used to enable
the user to purchase products and
service online and get charged directly
to their phone bill right then we have
the subscription process which requires
from the user to take some steps in
order for you to be valid
then we have the tall throat from the
other side malware which uh performed
these steps in order to simulate the
user interaction with the service and
perform what we call a fraudulent
subscription
and these steps as I said before you
include
navigate to the web enabled website
simulate the user clicks
intercept the OTP and send it back to
the server and finally keep all this
process silent all right
so
you might now think that we have a
malware which actually is uh the
behavior very complicated it uses a lot
of API calls a lot of permissions so it
can't be that hard to detect this type
of malware the behavior is very hard
testing you can create uh
very very specific signatures in order
to detect it so the answer is actually
here is that it is very hard to detect
this type of malware and white is very
hard to detect because it uses a lot of
detection evasion techniques and
um it uses for example steganography in
order to hide the payloads in seemingly
Banning files like JPEG files or PNG
files or even the assets folder
cryptography each sample has different
key for uh let's say it's made operating
strings obfuscation in order to evade
the static type signatures
Dynamic code loading simply said the
code is not there what you saw so far is
not in the initial APK itself it simply
gets downloaded and executed
and finally you have clocking so you the
model has to make sure that's uh certain
condition supply in order to perform the
steps dates a Sim operator is the Sim
operator targeted or uh
[Music]
does application runs in some kind of a
VM or something so this all these in
combinations are used for uh from the
malware debate detection and I have a
showcase here I have one of the latest
uh Joker
malware that we traced recently so this
actually is an SMS application which was
published in Google Play and what is the
first step what is doing as a first step
is just check if it's still published or
it got published in the Google Play so
send the next pay request to the Play
Store see if we are published and then
proceed to the first stage so the first
stage is to check the assets folder for
a specific file if this if this file is
there so make sure that um if we find
the file we change with 355 then we're
going to the next step and please notice
that in the first versions of this APK
this file was not there it was not
weaponized it was clean so later this
file was added there
and when this file
was found
user is in order to decrypt it the key
was hardcoded in the Dex file
use the screen or to decrypt the file
and the dropped file which is going to
be dropped actually in the data
directory of the applications actually
an L file it's a library it's going to
be loaded using the system.load and the
next step is
to trigger a native function which is
inside this initial payload
now we are moving to the stage two which
takes place on the native layer so here
what all the strings that we have of
course are encrypted sold actually and
they are sold back to the initial string
by using a key which is which derives
from the Java side
so decrypting the strings you can you
retrace calls to the Dex close loader to
the load class and actually to the name
of the next payload which we're going to
see in the next stage so
when everything is there when everything
gets decrypted the next step is to do
the same process but from the Native
layer now get again the assets folder
and search for another payload now this
payload is the one I show here which
ends with three zero zero and if this
payload is there it in order to get a
text file so whereas stage two we decide
we extort the file and now we have a
text file so this Dex file is going to
be loaded using the Dex was loader and
the load class with a specific class as
a parameter and finally perform a call
jni call
to the call static void method function
in order to call a function which is on
the Java side
so now we move again to the Java side we
have the third stage which is the Dex
file which is I talked to you about
before so now this Dex file will
communicate with the command control
server this command control server is
hard coded as you see in the file itself
so it will communicate there it will
download another file which file is a
jar file
and it will load this file by using both
Java Reflection actually and uh and the
text class loader in order to load it
and finally as the last step this file
will check if the same operator is
compatible is targeted and
it starts the steps that I showed you in
the first first slides
all right so to summarize this phase
what we have we have actually the
initial APK which is an SMS application
that you might even download from Google
Play It Was thousands of styles of uh
regarding this app and in the first
stage is going simply to check if it is
published and then it's going to take
take testified from the assets directory
this file is an L file and then
uh it's going to proceed to the second
stage which is Dell file that is going
to check again the assets folder create
another file which is a DEX file
this Dex file will communicate with the
command control server and download the
jar file a digital file will do the
final test which is check if the Sim
operators is targeted and do the actions
that we should show you before
all right now that we have a full
overview of the how it evades detection
how it performs this Dolph Road
uh
psych now let's see how it gets
published in the Google place in the
first place so
what the malware developer do malware
developers do is actually using what we
call a penetration strategy you want to
penetrate the Google play the play store
in order to be able to publish these
apps and get published as more as they
can so what they do is use open source
application that they belong to a very
very popular uh category for example
camera apps SMS apps Beauty editors
whatever you think
apps in general that can be can take a
lot of installs in very short time
and in the beginning this option
uploaded are published and weaponized so
wait for this apps to get a specific
threshold amount of installs and then
uh publish and updates create an update
which will contain the actual payload
the actual starting phase so
the last actually step here as I
mentioned here actually is that keep the
process keep the APK as clean as you can
right so
as you saw just this an asset file in
order to start everything and the rest
can be downloaded and executed
uh thankfully that this type of strategy
this penetration strategy that I show
you creates what we call secondary
signals and what we call what what we
what are those secondary signals so you
might see applications which
have excessive permissions for what
actually they're doing so you have a
camera app which requests you for an SMS
uh receiver or to read your SMS or to
bind the notification listener in
general you have applications that what
they request and doesn't make sense with
with their functionality right so the
other thing is that they have common
user interface characteristics for
example they have
common icons
uh policy Pages buttons similar packets
names
developer profiles and all this due to
the fact that these apps are mass are uh
massively Pro massive products so there
is a an automated process which creates
this type of uh of apps so you can
understand that they have similar
characteristics a lot of similarities
another thing of course is the user
comments although due to the fact that
this malware is like I said before you
it's an almost not perceivable from the
user side you can't you can't rely on
the comments in order to uh to to flag
this secondary signals
all right now let's see what chances we
have from a detection side from the
detection point and when we move to the
client side let's say the application
that that you have installed in your
device I'll be honest with you we don't
have many options here
and this is due to the fact that the
Android operating system uh imposes
serious restrictions on what one
application can retrieve for another
application each app is uh trapped in
its own sandbox
and the information that can't retrieved
for another
up is a let's say control string
strictly control from the operating
system itself so you can't do much here
what you can do is a simple static
scanner again which is based on uh
signatures you're going to retrieve from
the cloud or uh create use some kind of
a VPN in order to monitor the HTTP HBS
communication and maintain some kind of
a blacklist of command and control
servers and Trigger some kind of an
alarm when the device communicates with
such a server
when we move though to the cloud side
there are a lot of things that we can do
there and um
what we are trying to achieve is have
the best results using the less
resources that we can so
we this is a blueprint actually this is
a raw blueprint of uh of what we
suggested um
it is a multi-phase process which starts
with a steady feed so this feed imagine
that we have um apps we have a pool of
apps which can be fed stated from the
Google Play store or off Market or even
from the users or researchers and during
the first stage during the first
filtering these apps are going to be
filtered for the secondary signals I'll
talk to you about before
so check for similarities for um
uh common icons for Access permissions
and this this type of things and the
result is going to be either
the app doesn't have anything doesn't
seem to have any kind of this type of
signal or uh it is suspicious it has
some signals there is a specific uh but
it didn't reach a specific threshold so
it's going to Discount after the next X
amount of time and finally
suppose that it has a specific threshold
of signals then move to the next stage
now the next stage is a classic let's
say a traditional static scan so what we
do is scan uh the Manifest scan for
specific API calls or specific
permissions or specific strings and
again the result is going to be as
before
nothing due to the fact that this
missing critical
um a critical let's say API call or some
kind of a permission
that's not there
and uh or it has some so it's going to
be discount or finally it reaches at our
threshold and it's going to move to the
next stage which is the most demanding
from let's say a resources point of view
so
what we're trying to achieve here is to
trigger as much functionality as we can
uh and
um so we want to expose this
functionality as much as we can we might
we're trying to let's say interact in a
clever way with the malware and at the
same time observe
some things so what observe observe the
https communication of the malware use
binary instrumentation in order to log
uh the API calls or even under set this
API calls remember I told you that
search for specific Sim operators so try
to
change the return value of this specific
API calls
and
um see how it reacts or perform some
type of uh memory dump dump the Dex
files which might be loaded
uh
uh this actually can be used in order
also to uh
to bypass some type of protection for
example Packers or even in some cases
encryption
so check for uh drops files in the data
directory if something has been
downloaded or has has been decrypted and
dropped there
take this file and finally trace the jni
calls and of course dump the memory of
the Native space of the app and the
final result of this the final let's say
product of all these processes of course
to create signatures now these
signatures might be behavioral
signatures which are based on which are
more General and based on uh let's say
uh
API calls or permissions that I said
before
can be more specific and enrich our
database in which our signature
signature database in order to be able
to detect this uh malware in the early
stages earlier stages
so uh now uh I would say like a final
thought in regards to this type of
malware is prevention how what we mean
by prevention so
uh why does this have to be published in
the first place in Google Play Why an
app for example has to be enough camera
app for example or a beauty editor needs
this type of uh
permissions and why Google Play itself
allows the this application to use this
type of permissions to get published in
Google Play so at this point actually
Google make uh shoot steps and students
uh November 3rd 2021
the developer needs to complete what we
call a permission declaration form so if
your application is using some high risk
type of permissions or permissions that
they are using their
might be used in order to uh fetch the
user's private for info
so the developer has to to complete this
declaration form
despite that we haven't seen so far what
uh I mean we haven't seen any move when
it comes to notification service that I
talked to you about before and actually
is the one
that remains right now in the one that
we expect from Google to take action in
the future
yeah and uh yeah this was the last one
if there are any questions that uh
you want to ask
does anybody have uh any question
at this time
up here
Demetrius will be around and you'll be
able to uh have access to presentation
on the slides into your course on the
activity website so for now dimitrios
thank you thank you very much
[Applause]