Forest Global Training Partners

Cyber Risks · Cisco Talos

Android Basic Block Signatures

Summary: Cisco Talos described a ClamAV signature method for Android malware that parses the Java bytecode in classes.dex into basic blocks, each with one entry and one exit point, and keeps the first two bytes of every instruction while wildcarding the rest. The approach was adopted because ClamAV rejects signatures with only single-byte content matches, and because the second byte of an instruction, generally a register, stays mostly unchanged between versions of the same function.

What you should know: The author notes that any code added to a function breaks a signature and that signatures were pretty long, which is why blocks are selected by querying a database for those appearing in the most samples. Talos also notes Android malware authors have not yet started employing dead code injection, so the detection advantage this method relies on is a current condition, not a permanent one.

Read the original at Cisco Talos ↗

Topics
Malware
Related