Fraunhofer-Gesellschaft

Publica

Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

How to do it Wrong: Smartphone Antivirus and Security Applications Under Fire

Presentation held at Dev Con 2016, 12th October 2016, Plymouth
 
: Huber, Stephan; Rasthofer, Siegfried

:
presentation urn:nbn:de:0011-n-4230728 (3.4 MByte PDF)
MD5 Fingerprint: 6e89a9022d602380155881debd98d0ab
Created on: 22.11.2016


2016, 121 Folien
Conference "Dev Con" <2016, Plymouth>
English
Presentation, Electronic Publication
Fraunhofer SIT ()

Abstract
Todays evil often comes in the form of ransomware, keyloggers, or spyware, against which AntiVirus applications are usually an end users only means of protection. But current security apps not only scan for malware, they also aid end users by detecting malicious URLs, scams or phishing attacks. Generally, security apps appear so self-evidently useful that institutions such as online-banking providers even require users to install anti-virus programs. In this talk, however, we show that the installation of security applications, at least in the context of smartphones, can sometimes open the phone to a number of attack vectors, making the system more instead of less vulnerable to attacks. In a recent research we conducted on Android security apps from renowned vendors such as Kaspersky, McAfee, Androhelm, Eset, Malwarebytes or Avira. When conducting a study of the apps security features (Antivirus and Privacy Protection, Device Protection, Secure Web Browsing, etc.) it came as a shock to us that every inspected application contained critical vulnerabilities, and that in the end no single of the promoted security features proved to be sufficiently secure. In a simple case, we would have been able to harm the app vendors business model by upgrading a trial version into a premium one at no charge. In other instances, attackers would be able to harm the end user by completely disabling the malware-scanning engine remotely. Or how about accessing confidential data by exploiting broken SSL communication, broken self-developed advanced crypto implementations or through SQL-injections? Yes, we can. On top, we were able to bypass the secure browsing protection and abuse it for code execution. The most alarming findings, however, were security applications that we were able to actually turn into a remote access trojan (RAT) or into ransomware. In light of all those findings, one must seriously question whether the advice to install a security app onto ones smartphone is a wise one. In this talk, we will not only explain our findings in detail but also propose possible security fixes.

: http://publica.fraunhofer.de/documents/N-423072.html