Threats / 04 Malware

And although it may not always be categorized as malware, in this page we’ll also cover third-party libraries which developers integrate into their applications without knowing that they too might be malicious.

A mobile app consists of various components (or building blocks), but the fundamental ones are the User Interface (UI) Container, Data Provider, Background Worker, and Notification Observer. Depending on the OS or platform, some or all of these components can be made accessible. In other words, they can become entry points to your application. And that means that other apps, including malware, can interact with your application through any of these components. For example, your app can define an accessible data provider component to let other apps access its data and resources. That’s why it’s so important to make sure that accessible app components aren’t able to host any vulnerabilities. If they do, they’ll become easy prey for malware to exploit.

Let’s look at an example. Malware could access all the files of your application by exploiting the Path Traversal vulnerability in the app’s data provider components (Content Provider for Android or File Provider for iOS). How does it work? Well, the malware attacks by sending a specially-crafted path to obtain a handle of your application directory. And if your app stores sensitive data such as authentication tokens in that directory, then this vulnerability might lead to sensitive information leakage. This is a particularly dangerous threat for Android. A malware could also render your app inoperable or perform arbitrary code execution by taking control of a particular memory region in your app. It could interfere with the component that receives data from other applications and then try to process that data without any validation.

To access these functionalities, the requesting application needs to first register its own Accessibility Service to the OS through its manifest. The requesting app also needs to specify particular features of Accessibility Service that will be enabled. The OS will then start the requesting application’s Accessibility Service after the user's approval. A malware is likely to also specify the aforementioned functionalities above.

What makes Accessibility Service so attractive for malware is that it can help it to circumvent the sandbox or isolation provided by the OS to protect applications from unauthorized access to its protected resources. And without needing to look for exploitable application components. For example, auto-clicker apps can inject input actions into your app. Normally, injecting input actions into other apps without sufficient permission would result in an error thrown by the OS. But when using Accessibility Service, auto-clicker apps such as Automatic Transfer System (ATS) malware can easily work around these restrictions and achieve their objectives. The malware can also render your app unusable by displaying continuous overlays on top of it every time the user launches it.

Although it’s practically impossible for malware to do the same thing on iOS, it’s still possible for malware to interfere with your application through legitimate OS features. One example is taking advantage of the keyboard system. The malware could masquerade itself as a custom keyboard app and, once the user sets it as the default keyboard, it could intercept any keystrokes made by users of your application.

Malware might be able to take control of your application runtime by exploiting vulnerabilities within your app or by abusing OS features. For example, by corrupting a particular memory region within your app or displaying continuous overlays on top of your app, rendering it inoperable or unusable.

Stealing sensitive data is often the main goal of mobile malware attacks. By trespassing over your application sandbox system - perhaps exploiting vulnerabilities like path traversal - a malware can freely access and retrieve any data processed or stored by the app and then send it to the attacker’s C&C server. Abusing OS features like Accessibility Service in Android can make it easy for malware to steal end users’ data, including sensitive account credentials.

One point that should not be overlooked is the importance of educating your end users about reducing the risks of malware getting onto their device in the first place. As mentioned at the top of this page, malware is most often ‘invited’, through users downloading a malicious app or clicking a link. User education - including warning dialogs within the app - can go a long way to reducing the dangers and the costs of malware.

As a first step prior to exploiting a particular vulnerability, attackers will often decompile your app, analyze it, and figure out how it works and identify targets. Code hardening (obfuscation, encryption, virtualization) can add hurdles, making this type of reverse engineering through decompilation and static analysis difficult-to-impossible for attackers, as covered in the Decompilation and Modification threat page of this guide. And for the same reason, it’s equally vital to prevent dynamic analysis, as described in the Dynamic Analysis & Tampering threat page.