ALTERDROID: Differential Fault Analysis of Obfuscated Smartphone Malware

Abstract

This research investigates the effectiveness of Differential Fault Analysis (DFA) in reverse-engineering obfuscated Android malware. The increasing sophistication of malware obfuscation techniques necessitates robust analysis methods. This project aims to develop and evaluate a DFA framework specifically tailored for Android malware, focusing on identifying critical control flow and data manipulation components despite obfuscation. Our findings demonstrate the efficacy of DFA in revealing the underlying functionality of heavily obfuscated samples, highlighting its potential as a powerful tool in malware analysis. The framework's performance and limitations are discussed, paving the way for future improvements and applications.

Introduction

Android malware poses a significant threat to mobile security, with attackers employing increasingly sophisticated obfuscation techniques to evade detection. Static analysis methods often struggle to penetrate these obfuscation layers, hindering reverse-engineering efforts. Differential Fault Analysis (DFA), a powerful cryptographic technique, offers a promising alternative by injecting faults into the execution flow and analyzing the resulting behavioral changes. However, adapting DFA to the dynamic Android environment and handling the complexities of diverse obfuscation methods remains a significant challenge. This research addresses this gap by exploring the applicability and effectiveness of DFA against obfuscated Android malware.

Objectives

• Develop a DFA framework tailored for analyzing obfuscated Android malware.
• Evaluate the framework's effectiveness against various obfuscation techniques.
• Identify the limitations of the framework and propose improvements.

Technical Details

• Fault injection techniques applied in Android environments
• Reverse engineering of control flow and data flows in obfuscated malware
• Development tools: Android Studio, Java, Python (for DFA framework)
• Testing with real-world obfuscated malware samples
• Performance analysis and comparative results with static analysis