ARMAND: Anti-Repackaging through Multi-pattern Anti-tampering based on Native Detection

by   Alessio Merlo, et al.

App repackaging refers to the practice of customizing an existing mobile app and redistributing it in the wild to fool the final user into installing the repackaged app instead of the original one. In this way, an attacker can embed malicious payload into a legitimate app for different aims, such as access to premium features, redirect revenue, or access to user's private data. In the Android ecosystem, apps are available on public stores, and the only requirement for an app to execute properly is to be digitally signed. Due to this, the repackaging threat is widely spread. Anti-repackaging techniques aim to make harder the repackaging process for an attack adding logical controls - called detection node - in the app at compile-time. Such controls check the app integrity at runtime to detect tampering. If tampering is recognized, the detection nodes lead the repackaged app to fail (e.g., throwing an exception). From an attacker's standpoint, she must detect and bypass all controls to repackage safely. In this work, we propose a novel anti-repackaging scheme - called ARMAND - which aims to overcome the limitations of the current protection schemes. We have implemented this scheme into a prototype - named ARMANDroid - which leverages multiple protection patterns and relies on native code. The evaluation phase of ARMANDroid on 30.000 real-world Android apps showed that the scheme is robust against the common attack vectors and efficient in terms of time and space overhead.


page 17

page 26


You Shall not Repackage! A Journey into the World of Anti-Repackaging on Android

App repackaging refers to the practice of customizing an existing mobile...

PATRIOT: Anti-Repackaging for IoT Firmware

IoT repackaging refers to an attack devoted to tampering with a legitima...

Mascara: A Novel Attack Leveraging Android Virtualization

Android virtualization enables an app to create a virtual environment, i...

Automated Deobfuscation of Android Native Binary Code

With the popularity of Android apps, different techniques have been prop...

DeFiRanger: Detecting Price Manipulation Attacks on DeFi Applications

The rapid growth of Decentralized Finance (DeFi) boosts the Ethereum eco...

Detecting Data Leakage from Databases on Android Apps with Concept Drift

Mobile databases are the statutory backbones of many applications on sma...

ANDRUSPEX : Leveraging Graph Representation Learning to Predict Harmful App Installations on Mobile Devices

Android's security model severely limits the capabilities of anti-malwar...

Please sign up or login with your details

Forgot password? Click here to reset