Detection of malware apps that hijack app user interfaces
A computer-implement method of detecting malware apps includes receiving a sample app for a mobile operating system. The sample app is executed in an emulator of the mobile operating system. The behavior of the sample app in the emulator is monitored to collect a string that the sample app uses to detect whether or not a target app is running in a foreground of the emulator. A bait app, which is generated using the collected string, is switched to run in the foreground. The sample app is deemed to be a malware app when the sample app instead of the bait app is running in the foreground.
1. A computer-implemented method of detecting malware apps that hijack app user interfaces, the method comprising:
receiving a sample app of a mobile operating system;
running the sample app in an emulator of the mobile operating system;
monitoring behavior of the sample app in the emulator to collect a string that the sample app uses to detect whether or not a target app is currently running in a foreground of the emulator, wherein the collected string is a string employed by the sample app to detect a name of an activity of the target app;
generating a bait app configured as bait for a malware app to hijack using the collected string, wherein an activity of the bait app has the same name of the activity of the target app;
switching the bait app to run in the foreground; and
in response to switching the bait app to run in the foreground, deeming the sample app to be a malware app when the sample app instead of the bait app is running in the foreground.
2. The method of claim 1 , further comprising:
when the sample app is found to be detecting whether or not the sample app itself is running in the foreground, running a particular app in the foreground; and
deeming the sample app to be the malware app when the sample app instead of the particular app is running in the foreground.
3. The method of claim 2 , wherein the particular app is an app of the emulator of the mobile operating system.
4. The method of claim 1 , wherein the emulator comprises a sandbox.
5. The method of claim 1 , further comprising:
comparing the collected string to strings of activity names of known apps.
6. The method of claim 1 , wherein the sample app is received from a mobile computing device over a computer network.
7. The method of claim 1 , wherein the sample app is received from a smartphone.
8. A computer system for detecting malware apps that hijack app user interfaces, the computer system comprising a memory and a processor, the memory including instructions that when executed by the processor perform the steps of:
receiving a sample app of a mobile operating system;
running the sample app in an emulator of the mobile operating system;
monitoring behavior of the sample app in the emulator to collect a string that the sample app uses to detect whether or not a target app is currently running in a foreground of the emulator, wherein the collected string is a string employed by the sample app to detect a name of an activity of the target app;
generating a bait app configured as bait for a malware app to hijack using the collected string, wherein an activity of the bait app has the same name of the activity of the target app;
switching the bait app to run in the foreground; and
in response to switching the bait app to run in the foreground, deeming the sample app to be a malware app when the sample app instead of the bait app is running in the foreground.
9. The computer system of claim 8 , wherein the instructions further perform the steps of:
when the sample app is detected to be determining whether or not the sample app itself is running in the foreground, running a particular app in the foreground; and
deeming the sample app to be the malware app when the sample app instead of the particular app is running in the foreground.
10. The computer system of claim 9 , wherein the particular app is an app of the emulator of the mobile operating system.
11. The computer system of claim 8 , wherein the emulator comprises a sandbox.
12. The computer system of claim 8 , wherein the instructions further perform the steps of:
comparing the collected string to strings of activity names of known apps.
13. A computer-implemented method of detecting malware apps that hijack app user interfaces, the method comprising:
receiving a sample app of a mobile operating system;
running the sample app in a sandbox that emulates the mobile operating system;
monitoring a behavior of the sample app in the sandbox to collect a string that the sample app uses to detect whether or not a target app is currently running in a foreground of the emulated mobile operating system, wherein the collected string is a string employed by the sample app to detect a name of an activity of the target app;
generating a bait app configured as bait for a malware app to hijack using the collected string, wherein an activity of the bait app has the same name of the activity of the target app;
switching the bait app to run in the foreground; and
in response to switching the bait app to run in the foreground, deeming the sample app to be a malware app when the sample app instead of the bait app is running in the foreground.
14. The method of claim 13 , further comprising:
generating the bait app using a string employed by the sample app to make string comparisons to detect whether or not the target app is currently running in the foreground.