Mobile Malware Detection Comparison

Transcription

1 Mobile Malware Detection Comparison REVISION HISTORY Rev. Date Comment /21/ Initial Release Lionic Corp. 1F-C6, No. 1, Lising 1st Road, Science- Based Industrial Park, Hsinchu City 300, Taiwan, R.O.C.

2 For Further Information: Contact us Lionic Corp. 1F-C6, No. 1, Lising 1st Road, Science-Based Industrial Park, Hsinchu City 300, Taiwan, R.O.C. TEL: ext 590 FAX: Mobile malware detection rate (v1.0) March 21, 2011 Copyright 2011 Lionic Corp. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Lionic Corp.

3 Table of contents 1 Introduction Test methodology Test Environment Products tested Requirements for software Requirements for hardware Test result...7

4 1 Introduction The number of smart phone and tablets are blooming from last year Such device attract users because its capability in hardware design which integrate more and more functions like camera, GPS, G- sensor and so on, but also the flexibility for user to pick up the applications they preferred. More and more application packages are developed for mobile devices, and so-called Application Market is emerging to host and sell the applications. Besides downloading and installing from legal application markets, some users also get and install applications from under-ground markets and local web sites or forums. The attraction of such alternative source might be that application packages provided are modified to have local language support, or license removed. However, such underground or local web site/forum also become an efficient way and hot bed for malicious program writer to distribute their works. For example, the latest discover Android spywares like GEINIMI (*1), PJAPPS (*2), ADRD (*3), and Fake10086 (*4) take advantages of such methodology to spread themselves. Those three kinds of malware repackaged legal applications, and insert malicious code into the application. Once the application was activated, the malicious code either transmit privacy information to remote site owned by attacker or subscribe high bill SMS service. User privacy and money are infringed by this kind of attacks. Another distribution mechanism quite common is to utilize social engineering. For example, sending fake phishing mail to pretend as a friend of user, and persuading user to install some funny, or interesting, or adult related applications from the web sites. However, such applications are malicious and acts as spyware or sending high-bill SMS message. The Android malwares belong to this category are Tapsnake (*5), FakePlayer (*6). Therefore, mobile mal-wares had become an emerging issue for users. Especially in Android OS, since the applications are not reviewed and its openness. So, we want to give a comparison for all of products claimed to support the functionality of mobile security in Android OS. In the report, we focus on the number of mobile mal-wares detected by those products because the mal-ware detection rate is a very important index to evaluate the capability and strength of security function which security software performs. AegisLab ( is a leading company of security solution provider. We use hundreds of mobile mal-wares (300+ samples) collected and analyzed by AegisLab to be the test samples. The coverage and distribution for test samples are almost the same as mobile mal-wares in the wild, said by AegisLab. We hope this test report can not only help you to quickly understand the detection coverage of various existing mobile security products but also get security awareness about the risk.

5 *1: *2: *3: *4: *5: *6:

6 2 Test methodology In this chapter, we brief how to test the detection rate as follows. Before starting to test, a clean Android emulator as the figure 2-1 is needed. Each product was installed in this emulator with its default setting. Step 1: Install the latest version of anti-virus/anti-malware products. Step 2: Conduct the update mechanism (if any) to make sure the latest signature or mal-ware definition is updated. Step 3: Manually install all of malware samples and then inspect them one by one. Step 4: Conduct the scan and check the report. Step 5: Count the hit. Figure 2-1 Android emulator

7 3 Test Environment We list all of needed test requirements in the chapter. All of them include hardware and software. 3.1 Products tested Table 3-1 lists all products which we tested. We also updated their signature on 16th March, 2011 before starting test. Products tested Vendor Product Version AegisLab AegisLab Antivirus Elite NetQin Mobile Anti-virus 4.6 Lookout, Inc. Lookout Mobile Security Safe 360 Mobile Safe Doctor Web, Ltd. Dr. Web for Android Light NortonMobile Norton Mobile Security (Beta) Trend Micro Mobile Security 1.2 DroidSecurity AVG Antivirus Free - AVG 2.6 KASPERSKY Lab Kaspersky Mobile Security Superdroid.net Super Security Standard 1.03 Table 3-1 Products tested 3.2 Requirements for software Table 3-2 shows requirements for software. The followed is their descriptions. Software Number Windows XP 1 Android Emulator 1 (Ver. 2.1 Update1) Table 3-2 Software list 3.3 Requirements for hardware Table 3-3 shows the requirements for hardware. Each of them is described as followed. Equipment Number PC 1 Router 1 Table 3-3 Hardware list

8 4 Test result In this chapter, we summarize test result as followed figures. Figure 4-1 shows the mobile malware detection rate which tested based on 312 unique files. Figure 4-2 shows detailed summary of mobile malwares detection. Figure 4-1 Mobile malware detection rate Figure 4-2 Detailed summary of mobile malware detection