Skip to main content
Annual Computer Security Applications Conference (ACSAC) 2017

Full Program »

Supporting Transparent Snapshot for Bare-metal Malware Analysis on Mobile Devices

The increasing growth of cybercrimes targeting mobile devices urges an efficient malware analysis platform. With the emergence of evasive malware, which is capable of detecting that it is being analyzed in virtualized environments, bare-metal analysis has become the definitive resort. Existing works mainly focus on extracting the malicious behaviors exposed during bare-metal analysis. However, after malware analysis, it is equally important to quickly restore the system to a clean state to examine the next sample. Unfortunately, state-of-the-art solutions on mobile platforms can only restore the disk, and require a time-consuming system reboot. In addition, all of the existing works require some in-guest components to assist the restoration. Therefore, a kernel-level malware is still able to detect the presence of the in-guest components.

We propose Bolt, a transparent restoration mechanism for bare-metal analysis on mobile platform without rebooting. Bolt achieves a reboot-less restoration by simultaneously making a snapshot for both the physical memory and the disk. Memory snapshot is enabled by an isolated operating system (BoltOS) in the ARM Trust- Zone secure world, and disk snapshot is accomplished by a piece of customized firmware (BoltFTL) for flash-based block devices. Because both the BoltOS and the BoltFTL are isolated from the guest system, even kernel-level malware cannot interfere with the restoration. More importantly, Bolt does not require any modifications into the guest system. As such, Bolt is the first restoration mechanism for bare-metal malware analysis that simultaneously achieves efficiency, isolation, and stealthiness. We have implemented a Bolt prototype working with the Android OS. Experimental results show that Bolt can restore the guest system to the clean state in only 2.80 seconds.

Le Guan
Penn State University
United States

Shijie Jia
Institute of Information Engineering, Chinese Academy of Sciences
China

Bo Chen
Michigan Technological university
United States

Fengwei Zhang
Wayne State University
United States

Bo Luo
The University of Kansas
United States

Jingqiang Lin
Institute of Information Engineering, Chinese Academy of Sciences
China

Peng Liu
Penn State University
United States

Xinyu Xing
Penn State University
United States

Luning Xia
Institute of Information Engineering, Chinese Academy of Sciences
China

 

Powered by OpenConf®
Copyright ©2002-2017 Zakon Group LLC