Detection of App Collusion Potential Using Logic Programming

TL;DR

This paper introduces a logic programming-based method to detect potential app collusion in Android, effectively filtering large datasets to identify suspicious app sets for further analysis.

Contribution

The paper presents a novel filtering approach using first-order logic in Prolog to efficiently identify potential colluding app sets in large-scale Android datasets.

Findings

Successfully detected colluding apps in a dataset of over 50,000 apps.

Identified real-world apps using collusion to synchronize malicious payloads.

Validated the approach against manually crafted colluding apps.

Abstract

Android is designed with a number of built-in security features such as app sandboxing and permission-based access controls. Android supports multiple communication methods for apps to cooperate. This creates a security risk of app collusion. For instance, a sandboxed app with permission to access sensitive data might leak that data to another sandboxed app with access to the internet. In this paper, we present a method to detect potential collusion between apps. First, we extract from apps all information about their accesses to protected resources and communications. Then we identify sets of apps that might be colluding by using rules in first order logic codified in Prolog. After these, more computationally demanding approaches like taint analysis can focus on the identified sets that show collusion potential. This "filtering" approach is validated against a dataset of manually crafted colluding apps. We also demonstrate that our tool scales by running it on a set of more than 50,000 apps collected in the wild. Our tool allowed us to detect a large set of real apps that used collusion as a synchronization method to maximize the effects of a payload that was injected into all of them via the same SDK.

Figures

Tables

Table 1. Table 1: ASR signature of the SMS app (id 4) that is part of the Botnet group.

$A_{id4}$
Permissions	READ_SMS
	SEND_SMS
$S_{id4}=\varnothing$
$R_{id4}$
Intent	SMS_SENT
	sms

Table 2. Table 2: Summary of colluding app groups included in our basic app set.

Group	Id	Threats	Permissions	Colludes with	Channel
Document	1	Information Theft	READ_EXTERNAL_STORAGE	2	Shared Prefs.
Extractor	2		INTERNET	1	Shared Prefs.
Botnet	3	Information theft	INTERNET	4,5,6	Intents
	4		READ_SMS	3	Intents
		Service misuse	SEND_SMS
	5		READ_CONTACTS	3	Intents
	6	Money theft	GET_TASKS	3	Intents
			KILL_BACKGROUND_PROCESSES
Contact	7	Information theft	READ_CONTACTS	8,9	Intents
Extractor	8		WRITE_EXTERNAL_STORAGE	7,9	Ext. Storage
	9		INTERNET	7,8	Intents
			READ_EXTERNAL_STORAGE		Ext. Storage
Non-colluding	10	-	-	-	-
	11	-	INTERNET	-	-

Table 3. Table 3: Collusion Matrix of the Prolog program. ♣ ♣ \clubsuit = Information theft. $ = Money theft. ♠ ♠ \spadesuit = Service misuse. ♣ ♣ \clubsuit , $ , ♠ ♠ \spadesuit = Benign showing collusion potential.

app	1	2	3	4	5	6	7	8	9	10	11
1		$♣$								$♣$	$♣$
2
3				$$♣$	$♠$	$♠$
4
5			$♣$							$♣$	$♣$
6			$♣$	$♣$
7		$♣$						$♣$	$♣$	$♣$	$♣$
8									$♣$
9
10											$♣$
11

Table 4. Table 4: Summary of app sets used in our analysis.

	Malware	Unwanted	Clean
# of apps	13,805	13,991	22,378
# of overall installs	3,696,720	7,656,755	21,205,724,533
Avg size in KB	3,007.9	7,394.52	10,208.3

Equations

$$uses(App,P_{Internet})\to information\_outside(App)$$

$$uses(App,P_{Readcontacts})$$

$$uses(App,P_{SendSMS})$$

$$uses(App,P_{Killprocess})$$

$$send\_broadcast(App,Inten{t}_{send\_file})$$

$$\to send(App,Inten{t}_{send\_file})$$

$$send(Ap{p}_a,channel)\wedge receive(Ap{p}_b,channel)\to$$

$$communicate(Ap{p}_a,Ap{p}_b,channel)$$

$$sensitive\_info(Ap{p}_a)$$

$$information\_outside(Ap{p}_b)$$

$$communicate(Ap{p}_a,Ap{p}_b,channel)$$

$$information\_collusion(Ap{p}_a,Ap{p}_b)$$

$$money(Ap{p}_b)$$

$$communicate(Ap{p}_a,Ap{p}_b,channel)$$

$$money\_collusion(Ap{p}_a,Ap{p}_b)$$

$$information\_outside(Ap{p}_a)$$

$$money(Ap{p}_b)$$

$$communicate(Ap{p}_a,Ap{p}_b,channel)$$

$$money\_collusion(Ap{p}_a,Ap{p}_b)$$

$$information\_outside(Ap{p}_a)$$

$$control\_service(Ap{p}_b)$$

$$communicate(Ap{p}_a,Ap{p}_b,channel)$$

$$service\_collusion(Ap{p}_a,Ap{p}_b)$$

$$c_{intent}=\frac{apps\_sendin{g}_{intent}}{apps\_receivin{g}_{intent}}$$

Full text

1 Introduction

Smartphones are pervasive in modern everyday life. The number of smartphones in use is predicted to grow from 2.6 billion in 2016 to 6.1 billion in 2020 [1]. One reason for this fast adoption is the extensive ecosystem of apps for taking photos, sending messages, banking, and millions of other familiar uses. Smartphones hold a great deal of personal information (e.g., photos, finances, credentials, messages) making them very appealing targets for criminals who commonly use malicious apps to steal sensitive information [2], extort users [3], or misuse the device services for their own purposes [4].

To mitigate these threats, mobile operating systems offer a multi-sandbox environment where each app is executed in isolation from the rest. This isolation is intended to limit the effects of any potential malicious activity of an app. A way to get around this restriction is to execute a privilege escalation exploit or persuade the user to grant additional permissions to the app which usually works quite well because users are generally unaware of the risks associated with granting permissions to apps [5].

These restrictions can also be circumvented by app collusion. In collusion, the malicious activity is split across multiple apps coordinated through inter-app communications (IAC). This kind of attack is possible because sandboxed systems, such as Android, are designed to prevent threats from individual apps. However, they do not restrict or monitor inter-app communications and therefore they fail to protect from multiple apps cooperating in order to achieve a malicious goal. Most malware analysis systems, such as those that power antivirus software for smartphones, also check apps individually. While collusion is not common today, it opens an avenue to circumvent the security of Android and other sandboxed operating systems. And the risk of attackers taking this ”collusion avenue” is likely to grow because of constant enhancements in efficacy of static and dynamic analysis of individual apps as well as in calculating their reputations.

1.1 Contributions

In this paper, we present a methodology to detect the potential for app collusion by using logic programming. For each app, we extract what we call an ASR (Access-Send-Receive) signature. Then Prolog rules are used to characterize app collusion behaviours. These rules reflect two aspects of collusion: access to protected resources and communication channels between apps. Using the rules and the set of ASR signatures codified as Prolog facts, it is possible to obtain a list of potentially colluding app sets from large datasets of apps. We have validated the approach against a set of manually crafted colluding apps and then applied it to another set of more than 50,000 apps collected in the wild. Our approach has allowed us to shed light on how apps in the Android ecosystem communicate and it allowed us to identify a set of apps in the wild all having an embedded malicious SDK that used collusion to maximize the effects of a malicious payload. As with any rule-based method, our approach has limitations to known types of collusion. In principle, an approach such as anomaly detection might be able to detect new types of collusion that known rules can not, but it is currently not possible to test or compare anomaly detection until new collusion attacks occur (or become known).

The remainder of this paper is structured as follows. Section 2 reviews the Android security model focusing mainly on the aspects related to app collusion. In Section 3 we propose a definition of app collusion and describe possible communication channels that could be used by colluding apps. Section 4 describes our approach in detail and gives validation of our approach against a set of manually created colluding apps. Section 5 elaborates on how our method can scale up. Section 6 offers experimental results with a large dataset of apps in the wild. Section 7 reports a group of colluding apps found in the wild, that were flagged by our method. To the best of our knowledge, this is the first example of app collusion found in the wild. Section 8 reviews previous work done to detect and protect against app collusion.

2 The Android Operating System

The Android operating system model is designed to protect users, apps, the device and the network from malicious parties. By default, any third party app is considered untrusted by the OS and runs inside a sandbox that isolates it from any sensitive resource or other apps. Until Android 4.3, the sandboxing mechanism was implemented by assigning a different Linux user id (UID) to each app and configuring file permissions accordingly. Since Android 4.4 SELinux domains are used in addition to the Linux UID so apps can only access files inside its sandbox, as these are the only ones in its domain. Access to sensitive resources outside the app sandbox is possible by using APIs provided by the operating system. Calls to these APIs are managed by a permission system, which has a deny-by-default policy. Apps that want to access sensitive resources, must include a permission declaration inside its AndroidManifest.xml file. When the app is being installed (in Android versions below 6.0), the system will ask the user to accept the permissions used by the app before proceeding with the installation. At this point, the user must accept or deny all permissions requested by the app. Starting with Android 6.0, apps can ask for permissions at runtime and users have the choice of granting or denying each permission. However, permissions must still be declared in the manifest file. For a more detailed description of Android security features, we refer the reader to [6, 7].

2.1 App Components

Android apps are built with the following components:

• •

Activities represent screens of the user interface and allow the user to interact with the app. Activities run only in the foreground. Apps are generally composed of a set of activities.

• •

Services execute operations in the background. They are generally used by other components of the app to perform long-running tasks: listening to incoming connections, downloading a file, etc.

• •

Broadcast receivers respond to messages that are sent through Intent objects, by the same or other apps.

• •

Content providers manage access of other apps to the app’s own data. Apps with content providers enable other apps to read and write their local data.

In order to be reachable by other apps, components must be declared as exported in the app manifest file.

2.2 Communications

Besides the standard Unix files, sockets, etc., Android offers three inter-process communication (IPC) mechanisms:

• •

The Binder is a remote procedure call mechanism designed to enable fast and efficient IPC between processes that run inside a sandbox. The Binder Framework uses a server-client architecture. It is implemented as a Linux driver, allowing communications between sandbox boundaries.This allows the operating system to mediate communication across sandbox boundaries. The rest of the Android IPC (Intents and Content Providers) are, in fact, abstractions based on the Binder.

• •

An Intent is a messaging object which is used to request actions from other apps’ components. These can belong to the same or different apps. Intents can be explicit or implicit. Explicit intents target specific activities or services. Implicit intents target generic actions that can be performed by many different activities (send a message, open a web link, etc.). Activities, services and broadcast receivers declare the intents which they can handle by declaring a set of IntentFilters. For activities and services, intent filters must be declared in the app’s manifest. Broadcast receivers can also register their intent filters programmatically during execution.

• •

Content Providers are used to offer other apps a method to access their own structured data. Content providers store information in one or more tables, similarly to relational databases. Apps access data of content providers using ContentResolver objects. A content provider offers methods, which can be called by other apps, not only to read data, but also to update, create and delete information encapsulated in the content provider object.

None of these three IPC mechanisms, which all are standard in Android, is covered by the mandatory access control offered by SELinux [8]. As a result, apps can share any kind of information by using standard IPC without any restriction. To avoid security problems, Android allows apps communicating through IPC to request specific permissions to any app that wants to communicate with them. As an example, Android includes a Contact Provider to interact with the device’s contact list. Apps accessing this provider need to declare READ_CONTACTS or WRITE_CONTACTS permissions in their manifest. Similarly, apps using Intents to start phone calls require the CALL_PHONE permission.

Unfortunately, Android does not enforce this protection mechanism. It is left to app developers to decide if they want to apply it. Consequently, permission-protected resources are potentially exposed. This fact can be exploited to build colluding apps which access sensitive resources without permission. Apps might also communicate in order to aggregate permissions necessary to perform malicious actions.

3 App Collusion

The first mention of app collusion was Soundcomber, a proof-of-concept malware described in 2011 [9]. It was comprised of two apps which used inter-app communications to steal the user’s banking credentials. Soundcomber shows the limitations of the Android permission model to protect against apps that collude to aggregate their permissions [10]. Although collusion has inherently a malicious component, sometimes it is hard to distinguish collusion from collaboration.

A frontal attack on detecting collusion of pairs, triplets, and larger sets of Android apps is not practical given the search space. Thus, in this work, we aimed to develop an effective filtering system to quickly analyse large app sets to detect collusion potential so a security analyst or other more computationally expensive automatic tools can focus their efforts on the most suspicious app sets.

3.1 Definition of Collusion Potential

In this work, collusion refers to the ability of a set of apps to carry out an attack through collaboration. We assume that colluding apps can carry out the same malicious actions as single apps such as information theft, money theft, service misuse or sabotage [11].

To the best of the authors’ knowledge there is no evidence that collusion can create new threats in the mobile scenario, as they depend on the assets, which remain constant. However, collusion can change how attacks are executed. In the Soundcomber scenario, collusion is used to make an information leakage attack more stealthy. Additionally, malicious apps can also take advantage of collusion just for coordination and synchronization. Considering this, we define collusion potential based on the following:

• A1:

Actions are operations provided by the operating system (Android) API. We consider three kinds of actions. Access actions involve access to system-protected resources (e.g. record audio). Send actions allow apps to send information to other apps on the same device. Receive actions allow apps to receive information from other apps. Actions are grouped in what we call the Access-Send-Receive (ASR) signature of an app, denoted by $ASR_{app}$.

• A2:

Actions can be characterized by a number of attributes such as permissions, API calls, etc. In this work we use static analysis to extract attributes.

• A3:

A threat $t$ can be described by a sequence of actions $t=\langle a_{1},a_{2},\cdots,a_{n}\rangle$. In this work, we consider the threats to be the ones that can be created by single apps. Let $\tau$ denote the set of all these threats.

Definition 1** (Collusion Potential)**

A set $S$ consisting of at least two apps has collusion potential if the apps in $S$ together can execute a sequence $seq$ of actions such that:

$seq$* restricted to Access actions is a sequence in $\tau$; furthermore, $seq$ is collectively executed involving all apps in $S$, i.e., each app in $S$ executes at least one action in $seq$; and* 2. 2.

considering the Send and Receive actions in $seq$, all apps in $S$ are connected through communication channels. That is, it is possible to build a directed graph $G=(S,C)$ where the elements of $C$ are pairs of Send and Receive actions, in which there are no unreachable nodes, i.e. apps in $S$.

Our definition of collusion potential highlights two steps required for collusion: execution of a malicious action (threat) and the need to communicate between the apps executing these actions. Malicious actions and types of threats that can be executed by smartphone malware have been extensively studied by researchers [11, 12]. Due to the high level description of the actions it may happen that app sets marked as having collusion potential are taking advantage of other apps (permission re-delegation attacks [13]) or just collaborating. In this work we consider that both cases should be detected and highlighted as having collusion potential. As already noted by other researchers [14], the difference between a malicious or non-malicious behaviours can only be seen by comparing the application descriptions, developer intentions (which are difficult to measure by static analysis) and system implementations. So, in all these cases, apps can exhibit the exact same behaviour, and therefore must be considered to have collusion potential (i.e. in all three cases apps have the capability to collude). It is up to the security analysis or the taint analysis tools executed when app sets show collusion potential to decided whether one app is executing a permission re-delegation attack over another app, they are collaboration with the user knowledge or they are actually colluding.

In the next section we review the main communication channels that can be used by colluding apps. The development of the definition into a Prolog program to detect collusion potential is described in section 4.

3.2 Communication Channels for App Collusion

Colluding apps require some form of communication to execute and/or synchronize their actions. Colluding apps can use standard communication channels (as described previously in Section 2) or stealthy communications (often also called ”covert communications”) to avoid being detected. The following communication mechanisms may be employed:

• •

Intents can be used by colluding apps to share information. Broadcast receivers and services allow apps to exchange data without user intervention.

• •

Malicious apps can use content providers as a dropbox to exchange information. Access to system content providers requires apps to request permissions (e.g. WRITE_CONTACTS for the contact database).

• •

External storage of an Android device can also be used as a shared dropbox to exchange information. Apps accessing the external storage need to declare the READ_EXTERNAL_STORAGE or WRITE_EXTERNAL_STORAGE, depending on the required access. Files in the external storage can be accessed using the common file access API.

• •

Shared preferences are an Android feature that allows apps to store key-value pairs of data. Although it is not intended for inter-app communication, apps can use key-value pairs to exchange information if proper flags are defined (WORLD_READABLE or WORLD_WRITABLE) when accessing and storing data. Since the adoption of SELinux apps cannot access the world readable files of other apps, as they are confined to different SELinux domains.

• •

Colluding apps can also use standard Unix sockets to communicate through the local network interface. Communication between two apps that is mediated by an external server is not generally counted as collusion, because the communication happens outside the device domain.

• •

Covert channels may take advantage of APIs or features offered by the operating system to enable communication between processes [9, 15]. In Android, this includes publicly readable and writable settings (e.g. volume level) and capturing broadcast intents generated by the system. Additionally, processes can take advantage of covert channels present in most computing systems like file locks, process enumeration, free space and CPU usage.

4 Detecting Collusion Potential

Mobile apps can be downloaded from the web or app markets such as “Google Play.” These apps are analysed by market operators and anti-malware services that constantly crawl these markets. A combination of static and dynamic analysis techniques as well as statistical methods are used to establish reputation and risk values for an app. However, all these techniques consider apps in isolation and neglect to take into account other apps that could be installed on the same device. This hinders the detection of possible collusion behaviours from an appropriate combination of apps installed on the same device.

Our approach aims to extend app analysis services by also considering the collusion potential of sets of apps; the reputation and risk of an app are measured not only in terms of its own features, but also factoring in its capabilities when installed with other apps on the same device.

To do so, for each app we extract the actions it is able to perform as ASR signatures. These are described as Prolog facts. In a similar way, collusion potential is described as a set of logic rules that are composed by Prolog facts. Collusion rules can be applied to query for apps that may be potentially colluding. A detailed view of the process is given in the following sections.

4.1 Extracting ASR Signatures

We extract ASR signatures by performing a static analysis of the app manifest and app code. In this work we consider the usage of (i) implicit intents, (ii) shared preferences and (iii) external storage for communication, i.e., a subset of the channels listed in Section 3.2. Therefore, the ASR signature of an app is a combination of all permissions, intents, shared preferences and external storage channels that can be used by an app to send or receive information.

To analyse app code, we have extended Androguard [16], a reverse engineering tool for Android apps written in Python111Our code is available at https://github.com/acidrepo/collusion_potential_detector. Our extension looks up API calls involved in the creation and broadcast of intents and broadcast receivers and the access and modification of shared preferences files. Parameters that specify the communication channel for each method are tracked back through the code. We trace back the value of the action parameter for each broadcast intent and corresponding intent filters. In the case of shared preferences, we track the name of the shared preferences file. As with any static analysis tool, our tool is not able to trace back values that are dynamically defined. In those cases, we return the API call path that generates the value.

The app manifest is analysed to identify usage of external storage or static broadcast receivers. We are not able to obtain the specific channel used by apps through external storage. This requires identifying all API calls that can modify the external storage file system. PScout is able to identify the Android library API calls that require READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE permissions [17]. However, standard IO calls are not included in this mapping. Therefore we have left this task for future work.

As an example, Table 1 shows the ASR signature of a simple artificial colluding app that would send premium SMS messages. This app requires READ_SMS to display the user’s SMS and SEND_SMS to send SMS. This permission is abused to send SMS messages when an intent with the action sms is received. Details about this app, and the rest of the apps created for validation purposes, can be found on section 4.4.

4.2 Characterizing Collusion Potential with Logic Rules

Our approach to detect collusion potential utilises logic programming in Prolog. We have created a Prolog program, the ACiD (Application Collusion Detection) rule set, that defines when a set of applications shows collusion potential.

Access actions have been categorized into four high level actions: accessing sensitive information; use an API that can incur a financial loss; control device services (e.g. camera); and send information outside the device. These actions are characterised by permissions and API calls which are mapped to one or more of the four high level actions. For example, an app that declares the INTERNET permission will be capable of sending information outside the device:

[TABLE]

Similarly:

[TABLE]

Overall, in Android 4.3 35 permissions can be used to access sensitive information; 12 to send information outside the device; 3 to execute financially-sensitive APIs; and 39 to control device services. The complete mapping of permissions to actions can be found on the project repository.

Send and Receive actions are characterised by specific API calls offered by the Android OS. For each we create a fact that describes that communication action. When using Intents and SharedPreferences we are able to specify the communication channel using the intent actions and preference file respectively. As an example, if an app sends a BroadcastIntent with an action SEND_FILE we consider the following:

[TABLE]

We consider that two apps communicate if one of them is able to $send$ and the other to $receive$ via the same channel.

[TABLE]

Note that communication is directed, i.e., information flows from $App_{a}$ to $App_{b}$.

Finally, each of the threats is characterised by a sequence of actions. Our threat set $\tau$ considers information theft, money theft and service misuse. Specifically, we consider that two apps have collusion potential to execute an information theft when one of them has access to sensitive information and communicates with another app which can do external communications:

[TABLE]

We consider that two apps have potential to collude for money theft when one app has access to cost sensitive APIs and receives information from another app:

[TABLE]

An internet connection in $App_{a}$ would allow a server to send commands to an app with access to cost sensitive APIs:

[TABLE]

In a similar sense, this same app could also send commands from a C&C server to other apps that have access to device services:

[TABLE]

4.3 ACiD Rule Set in Prolog

We have translated the ACiD rules into a Prolog program. These include the rules required to identify communication paths (and specific channels) between applications. Then, once the ASR signatures have been extracted from an app set, they can be translated into Prolog facts to be part of the Prolog program that is executed to find collusion potential.

For every permission used by an app a Prolog fact uses(app) is created. For every channel sending information outside the app sandbox we generate a send(app,channel) fact and recv(app,channel) for all channels receiving information from outside the sandbox.

A Prolog predicate (q :- p) describes a logical rule of the form $p\rightarrow q$. Prolog uses modus ponens to evaluate queries and look for results. If p is true, then it will consider q to be also true. The identification of communication paths between apps is performed by using recursive Prolog predicates (Listing 1). The base case (first rule) identifies when two apps are communicating. This is, if AppA sends information through Channel and AppB receives information from the same channel, it means they communicate (comm_l(AppA,AppB,2,_,[]). The recursive predicates (last two rules) add more apps to the communication path. To avoid circular paths, all rules check if the app that is being analysed is already a member of the path (nonmember).

The channel rules allow, once a collusion path has been obtained, to extract the list of communication channels used by the apps (Listing 2). Similarly, the first predicate (first rule) saves the channel used when two apps are communicating. The second predicate looks recursively for the rest of the channels These rules facilitate the security analyst task to investigate how the potential collusion can happen.

4.4 Validation

We have performed an initial validation by running it through a set of eleven specifically developed artificial apps that include colluding and non-colluding apps222Due to the malicious nature of the apps, they are only available upon request. which are summarized in Table 2. We have decided to use apps developed by us for two reasons. First, to the best of our knowledge, no colluding apps have been identified in the wild yet. Thus, we lack a set of previously known positive examples. Second, even if there were apps identified as colluding, we could not be 100% certain on non-collusion: even an app downloaded from a reputable market might be colluding. i.e., we lack a set of previously known negative examples.

There are nine colluding apps that have been developed to cover all collusion scenarios described in Section 3. They can be categorized in three groups:

• •

The Document Extractor group is composed of two apps. One of the apps in the group looks for sensitive documents (txt, pdf, db, xls, etc.) on the external storage ($app_{1}$). This information is shared with $app_{2}$ using the shared preferences. The information received is sent to a remote server.

• •

The Botnet group is composed of four apps. One of the apps ($app_{4}$) acts as a relay that receives orders from the command and control center. The other colluding apps execute commands depending on their requested permissions. They are capable of sending SMS messages ($app_{4}$), stealing the user’s contacts ($app_{5}$) and starting and stopping tasks ($app_{6}$). This group uses intents as communication channel.

• •

The Contact Extractor group is composed of three apps. This group sends the device’s address book to a remote server. The first app ($app_{7}$) reads the contacts from the address book, the second ($app_{8}$) forwards them to the third ($app_{9}$), which sends them to the Internet. This group uses intents and the external storage as communication channels.

In addition to the colluding apps, the validation set includes two non-colluding apps. These are a document viewer ($app_{10}$) and an information sharing app ($app_{11}$). The first app displays different file types on the device screen and uses other apps (through an intent with the action android.intent.action.SEND) to share their uniform resource identifier. The second app receives text (through the same action) and sends it to a remote server.

4.5 Validation Run

Table 3 shows the results obtained from analysing the crafted colluding app set. “Dark red club” entries show when we detect collusion potential. As an example, the entry in row 1, column 2 means: the program detects that $app_{1}$ sends information to $app_{2}$, and these two apps collude to perform “information theft”. As we take communication direction into consideration, the resulting matrix is non-symmetric, e.g., there is no entry in row 2, column 1. Additionally, our approach is able to identify transitive collusion attacks (i.e. $app_{7}$ colluding with $app_{9}$ through $app_{8}$).

‘Gold club” entries show apps flagged as having some collusion potential by our approach but not colluding in reality. For instance, the entry in row 1, column 10 means: the program flags collusion of type “information theft” though the set {$app_{1}$, $app_{10}$} is clean. However, they are just exchanging information. As stated in our definition of collusion potential, some benign apps can share access to sensitive resources (e.g. a location being shared from a maps app to a social media app). As we consider all Android available channels as suitable for collusion, in our first approach apps using common channels such as intents with VIEW or SEND actions that are very commonly used in Android are also considered to have collusion potential. However, it is unlikely to see apps using these channels for collusion as other apps could have registered to receive the same information. We have taken this fact into consideration when scaling up our methodology (Section 5).

Overall, our approach identifies all colluding app sets but it also flags eight cases with collusion potential where apps are just collaborating.

5 Scaling up

Our initial methodology takes an app set and finds all potentially colluding app sets. This works as long as the app set to analyze is a reasonable size (i.e. the number of apps that are regularly installed on a regular smartphone, about 20 to 30). However, if the number of applications to analyze is larger, scalability problems arise.

5.1 Collusion Potential and Computational Complexity

Figure 1 shows an estimation of the maximum number of potentially colluding sets depending on the size of the app set to be analyzed. These estimates correspond to the possible combinations of $k$ apps in a group of $n$ apps.

As the number of apps increases, the number of potentially colluding sets increases exponentially. Therefore, if the analyzed apps show a high degree of communication capabilities, the number of potentially colluding app sets will become unmanageably large.

5.2 Managing Complexity

To address scalability, we improved the Prolog-based methodology considering the way Android works. Android’s design philosophy strongly promotes the use of intents and other IPC communications in order to improve user experience. Consequently, many communication paths detected by our method will be benign, generating alarms for app sets that have collusion potential, but are just collaborating. If we were able to identify and remove these benign communications, then the corresponding potentially colluding sets would be reduced drastically.

We analyzed communication signatures generated by more than 50,000 apps included in our experiment dataset (Section 6). Up to 40% of the analyzed apps have the capability to read from and write to external storage. Our approach does not identify specific files accessed in the external storage. Consequently, our crude initial approach would consider all these apps to be capable of communicating with each other. However, this is not true and fails to represent their real behaviour. We decided to leave out external storage as a communication channel when scaling up our approach. Identification of specific files opened by each app is left for future work.

Similarly, we filtered out some common intents used by apps to exchange information. Specifically, we have removed the following intent-based communications333The full list of such intents can be found in our github repository:

• •

Intents that can only be generated by the operating system. These can be found in the Android Open Source Project Git page444https://android.googlesource.com. We have identified 253 intent actions in this category.

• •

Intent actions that are created by common and trusted third party applications such as Facebook, Dropbox, etc. These are sent by applications that want to interact with these apps, but only the apps from the same developer (Facebook, Dropbox, etc.) receive them. We can detect them by inspecting intents sent and received by the clean apps of our data set – c.f. Section 6.1 for details. Intents exhibiting this behaviour will be received by one (e.g. Facebook) or a small number of apps (e.g. apps implementing the Facebook API). To rule out such intents we measured the amount of apps that send the intent divided by the ones that are able to receive it:

[TABLE]

Any intent action included in the aforementioned apps or with a $C_{intent}\geq 5$ has been included in this list. We have obtained 693 intent actions to filter by using this approach.

• •

Intents that are used to execute common tasks such as view a document (android.intent.action.VIEW); send something (android.intent.action.SEND); or open an application (android.intent.action.MAIN) are widely used in the Android ecosystem. Some of these are defined in the Android documentation555http://developer.android.com/reference/android/content/Intent.html. These kinds of intents are widely sent and received by apps. As they are declared by many apps, in most cases, the user will be asked to select the app to handle the intent, making the collusion attack infeasible. We have identified 208 intent actions matching these characteristics.

6 Experiments

We have used our methodology to look for collusion potential in a set of 50,174 apps provided by Intel Security (McAfee). The goal of this analysis was to shed the light on the way Android apps communicate and to test if our approach can deal with high numbers of apps found in the wild. As our approach focuses on specific, selected communication channels, it might happen that apps not flagged by our approach could be colluding as they use a channel which our analysis does not track.

6.1 Dataset Description

The dataset contains 50,174 Android apps collected from February 2012 up to February 2016. These apps have been categorized by Intel Security into 3 app categories: malicious, potentially unwanted, and clean. Potentially unwanted apps are typically related to excessive advertising, mild privacy invasions and other misbehaviours which cannot be classified as outright malicious. Apps that are known to lack any malicious behaviour are labelled as clean. Table 4 shows a summary of the three groups.

6.2 Usage of Communication Channels

We first checked if there is a difference between the usage of intents and shared preferences as communication channels. Figure 2 shows the distribution of individual channels found in each of the analyzed app sets (after filtering out common intents). Our first observation is that intent based communication is more predominant in the three analyzed app sets. This is expected result because intent based communications is the suggested method for inter-app communication in the Android documentation.

6.2.1 Shared Preferences based Channels

We found a significant difference in the amount of individual channels that use shared preferences for the malicious and unwanted app sets. Shared Preferences are not originally intended for application communication. If a developer wants to make a shared preference file accessible outside of the sandbox, he needs to explicitly override the default flag value (WORLD_READABLE or WORLD_WRITABLE). Therefore, it is more likely that the presence of such channels indicates deliberate information sharing rather than mistakes during app development.

We have further analyzed how the most common shared preference channels are used. Figure 3 shows the number of apps in each set using each of the top ten identified channels to send or receive information.

Next we manually analyzed samples of the apps employing these communication channels. We found that apps using shared preferences as channels fall into three categories. First, there are some apps that dynamically define the package and preference file they write to or read from ($SP4$). In this case, each app uses the preference file for a specific purpose and it is not possible to extract a behavioural pattern. Second, some apps access preference files that have the same name as their app package ($SP7$). These apps also exhibit different behaviours so it is not possible to extract a pattern from them. The third category consists of the rest of the channels, which are the ones that can be directly mapped to a string value or a call graph. We have found out that all these channels were related to using specific software libraries.

The most used shared preference channels in Figure 3 were traced back to five different libraries. Channels $SP1$, $SP5$ and $SP8$ are included inside a SDK that belongs to the Chinese company Play.cn. While most apps including it are categorized as malicious or potentially harmful, some of them are considered clean. These apps should be further analyzed to determine their behaviour. Channel $SP2$ is created by the OpenUDID library. This library, which is now discontinued, was used to generate a unique identifier that could be shared between different apps. This behaviour puts the user’s privacy at risk: it can be used by different apps to correlate if they are installed in the same device. $SP3$ and $SP9$ belong to a library developed by the Chinese company Baidu. We have been able to identify a colluding behaviour by apps using this SDK, which is described in detail in Section 7. Channel $SP6$ belongs to apps including the Adobe Air SDK. The preference file is read by a method named getTelemetrySettings. We did not find any app writing into that file in any of our three app sets. Finally, channel $SP10$ belongs to apps including the Heyzap advertising library. Again, no apps in our three datasets were found writing data into that file.

6.2.2 Intent based Channels

Figure 4 shows the number of apps that use the most frequent intents in all the three sets of apps. Analyzing intent communication is more challenging than shared preferences communications. Depending on the app component (activity, service or broadcast receiver) used to match an intent, it is not possible to see by static analysis if it is intended for the same app or a different one. Additionally, as seen with $I3$ and $I4$, we have not detected any receiver that uses intent actions defined programatically. This is because components that receive intents are generally defined statically with strings inside the AndroidManifest.xml file.

We have found that intent based communications can also be used to help with app classification. In Figure 4, malicious and unwanted apps use inter-app communication channels that are not being used by clean apps.

As with the shared preferences, we analyzed the origin of the predominant communication channels found in our analysis. Most of them belong to libraries provided by advertisement companies. $I1$ is included in an aggressive ad library known as apperhand. $I2$, $I4$, $I8$ and $I9$ belong to the AirPush advertisement library. The Sendroid ad library includes the communication channel $I3$. Finally, $I5$, $I6$ and $I7$ are included inside the Startapp ad library while $I10$ appears in a Chinese library called umeng.

6.3 Collusion Potential

Using Prolog to analyze collusion potential provides a great deal of flexibility, by simply modifying the Prolog rules to define collusions to look for. We have focused on analyzing collusion potential of app sets formed by 2 or 3 apps that may try to extract the accounts, SMS messages or the device contact list. We have limited the size of app sets to two and three for two reasons. First, it is unlikely that an attacker has the resources to make the user to install more than 3 apps. Second, larger app sets will be composed of smaller subsets. Finding them is just a matter of combining smaller colluding app sets. Listing 3 shows the Prolog rules required to identify apps with collusion potential that may affect the accounts, SMS messages or the contacts of the device.

Figure 5 shows the percentage of apps inside each set that exhibit collusion potential for any of the analyzed permission-protected resources (accounts, SMS and contacts). Results show that at least the 70% of apps in each of the datasets do not exhibit collusion potential regarding the analyzed resources. This greatly reduces the number of possible apps to analyze further. Apps inside the malware group exhibit more collusion potential than apps in the other categories (with the exception of accounts in the clean dataset). This is because malware apps generally request more permissions [18] and the inclusion of advertisement libraries, as we saw in the previous section.

The potentially unwanted app set includes apps with a less collusion potential. This is a contradictory behaviour. However, when analyzing the amount of apps that have colluding potential inside each of the groups, we found an explanation. Figures 6 and 7 show the number of apps that can receive each sensitive protected resource from an app that has been identified to have collusion potential. Although apps inside the unwanted group have a smaller number of apps capable of leaking sensitive information, they are able to share them with a much higher number of apps than apps in the other categories. This is because apps in this group include aggressive advertisement libraries such as the ones described in the previous section.

Apps in the clean set have the smallest number of potentially colluding pairs, while malware apps have a higher number of potentially colluding app pairs regarding accounts. This happens because clean apps request account related permissions more often but communicate with fewer apps, while malware apps require slightly less access to accounts, but communicate with many more apps.

This pattern remains when analyzing the number of potentially colluding triplets generated by apps with access to the analysed resources. The main difference is the magnitude on the number of colluding triplets, as the number of possible combinations increases.

6.4 Time Efficiency

The process required to find app sets with collusion potential is split in two phases: extracting the ASR signatures and executing the Prolog program. The first phase needs to be executed only once per app, as signatures can be stored in a database. The second phase is executed every time the fact database is updated (i.e. when a new app is analyzed). It should be noted that our analysis is not bidirectional as we identify the direction of the information flow.

Figure 8 shows the time required to extract the ASR signatures from an app, depending on the size of the classes.dex file. All experiments were executed on a commodity PC with an Intel Core i5 2.7 GHz processor and 8GB DDR3 RAM. As expected, time grows with the amount of code to be analyzed. Obtained times fit with a linear function with an R-Square of 76%. For example, a 9.5 Mbyte file requires around 4 seconds of processing. Note that we have not put an emphasis on optimizing the ASR extraction code.

Figure 9 plots the time required to execute a Prolog query depending on the number of colluding sets found for each app. Queries for apps that do not exhibit any colluding behaviour take 30 ms on average. When looking for potentially colluding app pairs, the maximum query time obtained during our experiments was 216 ms. The higher times shown in Figure 9 were obtained when looking for colluding app triplets. Obtained times fit with a polynomial of grade 2 with a R-square of 71%. Analysis time could be reduced by stopping queries at the first match. In this way, only apps with one match would be analyzed further.

7 Colluding Behaviour of MoPlus SDK

During our experiments querying for potentially colluding app pairs, we identified a group of apps that was communicating using both intents and shared preference files. A manual review of the flagged apps revealed that they were sharing information through shared preferences files to synchronize the execution of a potentially harmful payload. This payload was embedded into all the apps through a library, the MoPlus SDK. This library has been known to be malicious since November 2015 [19]. However, the collusion behaviour of the SDK was unknown. In the rest of this section, we briefly describe the malicious behaviour of the SDK and provide a more detailed analysis of its colluding behaviour. To the best of our knowledge, this is the first instance of collusion found in the wild.

7.1 Malicious Payload

The MoPlus SDK has the ability to open a local HTTP server on the user device. This enables the attacker to perform a series of malicious operations including:

• •

Send arbitrary intents received via the command and control (C&C) server.

• •

Obtain sensitive information from the user’s device, including the user location and the IMEI.

• •

Install apps silently in rooted devices.

• •

Add contacts received from the C&C server.

The malicious payload embedded inside the MoPlus SDK inherits all permissions requested by the app. As these are chosen by the app developer, which may differ from the SDK developer, it is possible that an app including the SDK does not have the necessary permissions to execute all the library’s malicious payload. The colluding behaviour of the MoPlus SDK aims to avoid this problem by identifying which of the apps that include the MoPlus SDK and are installed in a device have most access to system resources.

7.2 Colluding Behaviour

The detected colluding behaviour differs from the standard colluding behaviour studied in most app collusion research [9, 15]. In a nutshell, all apps including the MoPlus SDK that are running on a device will talk to each other to check which of the apps has the most privileges. This app will then be chosen to execute the local HTTP server able to receive commands from the C&C server, maximizing the effects of the malicious payload.

The MoPlus SDK includes the MoPlusService and the MoPlusReceiver components. In all analyzed apps, the service is exported. In Android, this is considered to be a dangerous practice, as also other apps will be able to call and access this service. However, in this case it is a feature used by the SDK to enable communication between its apps.

The colluding behaviour is executed when the MoPlusService is created (onCreate method). This behaviour is triggered by the MoPlus SDK of each app and can be divided in two phases: establishing app priority and executing the malicious payload. In the next sections, we will describe this behaviour in detail with reconstructed code samples. These have been obtained by reconstructing part of the code from the Baidu Searchbox app with MD5 062f91b3b1c900e2bc710166e6510654 signature. Locations of different payloads may differ from app to app, as code is generally obfuscated by using Proguard.

7.2.1 Establishing app priority

During SDK initialization, the MoPlusService is created inside each app with the MoPlus SDK. The service executes three checks (Listing 4):

The version of the MoPlus SDK is checked against a value stored in a preference file (lines 3 to 5). 2. 2.

The SDK looks for the tag DisableService inside the AndroidManifest (!a(Context), line 8). If it is found, it will not continue to execute. 3. 3.

The SDK checks if the app executing the SDK has all the necessary components of the SDK and the minimum permissions required by the SDK have been granted (j(Context), line 8). The minimum permissions required to continue execution are: INTERNET, READ_PHONE_STATE, ACCESS_NETWORK_STATE, BROADCAST_STICKY, WRITE_SETTINGS, WRITE_EXTERNAL_STORAGE, SET_ACTIVITY_WATCHER, GET_TASKS.

If any of these checks fail, the service assigns itself a zero priority inside a preference file readable by the rest of the apps installed in the system (line 11). The name of the preference file is created adding the extension .push_sync to the app package name. The SDK uses the WORLD_READABLE flag to save the file so other apps can access it.

If the three checks hold, the service executes the method f(Context). This method computes a priority to the app that depends on several factors (Listing 5).

These include, from lowest to highest priority:

Several meta-data values from the manifest (lines 3 to 15): DisableLocalServer, DisableStatistic, DisableApplist, isBaiduApp. 2. 2.

Access to the contact lists (lines 17 and 18). 3. 3.

If the app is part of the system image (l. 20 and 21). 4. 4.

A priority value included in the manifest (line 22).

The obtained priority is saved in the preference file with push_sync extension. This behaviour is executed by all apps including the MoPlus SDK (Figure 10).

7.2.2 Executing the malicious payload

After the priority has been obtained and stored, the service method OnCreate() calls the method a(Context,long) (Listing 6) to create and broadcast a new intent object.

The localIntent value is obtained from the execution of the method c(Context) (line 3). This method creates the intent that will start the MoPlusReceiver (Listing 7).

The call to d(Context) (line 4) looks for the app package with highest priority through the method a(Context,String,String) (Listing 8).

The method a(Context,String,String)looks for all the packages that are able to answer the Intents included in the MoPlus SDK (Listing 9, lines 3 to 6): com.baidu.android.moplus.action.START and com.baidu.android.pushservice.action.BIND_SYNC.

For each package found, it inspects the contents of the push_sync file to get its priority, returning the package name of the one with highest priority (Figure 9, line 10 to end). The intent to be launched is configured so only receivers in the returned package can receive it (Listing 6, line 4). Finally, the method a(Context, Intent, long) (Listing 10) cancels previous intents being registered (to avoid launching the service more than once) and sends the intent after a delay passed as a parameter.

The described behaviour is executed by all apps that include the MoPlus SDK libraries (Figure 11).

8 Related Work

Countermeasures for fighting collusion attacks can be grouped into two categories: static analysis and Android OS extensions. ComDroid [20] is a static analysis tool that looks for confused deputies through Intents. $\mathbb{K}$droid [21] detects collusion via software model-checking a set of Android apps utilising the $\mathbb{K}$  framework. PermissionFlow uses taint analysis to automatically detect inter-application permission leaks [22]. In their work they found that more than 50% of the top 313 apps (in 2012) actively used inter-component information flows and four of them leaked permissions to other apps. Our work differs from PermissionFlow in our lack of taint analysis and our consideration of channels that may be used specifically for collusion (e.g. shared preferences). Taint analysis allows PermissionFlow to be more precise, but at the same time more computationally costly. Our system could be used to filter out app sets without colluding potentially, focusing the more computationally complex analysis on those that exhibit collusion potential.

In contrast to these, XManDroid [10], TrustDroid [23] and [24] extend the Android OS by providing finer control over app communications. These extensions identify possible communication paths between apps and allow to define policies that control how they exchange information. These are similar to the ones provided by the Intent Firewall included as a component, not enabled, of recent Android versions [25]. TrustDroid provides additional controls to monitor the file system and network connections. However, none of them provide a monitoring system for shared preference files and other covert channels. As we have found during our research, these communication channels are also a viable means of communication between colluding apps.

Bartel et al. [26] propose the tool APKCombiner which joins two apps into a single APK file. In this way, a security analyst can use IPC analyzers to analyze the IAC mechanisms. Their evaluation over a set of 3000 apps shows that the approach is valid, as it is capable of joining together 88% of the possible app pairs. The average time required to join two apps is three minutes. This makes it hard to use for practical large-scale app analysis.

9 Conclusions

Detecting app collusion on a large scale is a challenging task due to the sheer amount of possible app combinations and communication channels. We have presented a method to analyze large sets of apps to look for collusion potential. Our method is based on a lightweight analysis of apps that extracts ASR signatures. These are transformed into Prolog facts, so logic programming can be used to identify collusion potential between apps in an efficient way.

We have validated our approach against an artificial set of apps and tested it against a large dataset of ’in the wild’ apps. Our results show that malicious apps use inter-app communications in a different way than clean ones. Malware classification methods could take advantage of this fact to increase their accuracy and to detect collusion.

A manual analysis of some of the apps flagged by our detection system allowed us to identify the first known case of collusion in the wild. This discovery demonstrated the risk of using untrusted or maliciously modified SDKs. The designers of these app communication scheme even considered the possibility of the SDK being included as part of a system image. Identified colluding apps synchronize with each other (by sharing a priority value) activating only the service within the more privileged app. This finding demonstrates the need to focus on alternative methods of communication when looking for colluding apps. Although intent based communications are more common, other means of communication (such as the shared preferences and covert channels) should also be considered. Our future direction of work aims to explore these communication channels and to use formal verification methods to automatically analyze apps flagged by our system.

Acknowledgment

This work has been supported by UK Engineering and Physical Sciences Research Council (EPSRC) grant EP/L022699/1.