Following Devil's Footprints: Cross-Platform Analysis of Potentially Harmful Libraries on Android and iOS

摘要: It is reported recently that legitimate libraries are repackaged for propagating malware. An in-depth analysis of such potentially-harmful (PhaLibs), however, has never been done before, due to the challenges in identifying those whose code can be unavailable online (e.g., removed from public repositories, spreading underground, etc.). Particularly, an iOS app, library it integrates cannot trivially recovered its binary and analyzed by any publicly available anti-virus (AV) systems. In this paper, we report first systematic study on PhaLibs across Android iOS, based upon a key observation many have versions potentially used understand their behaviors relations between both sides. To end, utilize methodology clusters similar packages large number popular apps identify libraries, strategically analyze them using AV systems find PhaLibs. Those then search counterparts within Apple invariant features shared cross platforms. On each discovered PhaLib, our approach further identifies suspicious also appear version uses system side confirm indeed harmful. Running 1.3 million 140,000 downloaded 8 markets, 117 with 1008 variations 23 706 iOS. Altogether, found infect 6.84% Google Play embedded thousands apps, 2.94% among official App Store. Looking into PhaLibs, not only do discover as mobiSage, but 6 other back-door known before. contain risky reading host apps' keychain, stealthily recording audio video even attempting make phone calls. Our research shows most Android-side harmful preserved corresponding new evidence about repackaging propagations