• Proceedings of the Korean Society of Computer Information Conference
• /
• 2014.07a
• /
• pp.57-59
• /
• 2014

공개 플랫폼을 지향하는 안드로이드는 손쉽게 안드로이드 설치파일(APK)를 얻을 수 있어 디컴파일 하기 쉽다. 보안에 민감한 금융 앱이나 웹서버를 이용하여 데이터를 주고받는 앱일 경우 역공학을 통해 얻는 정보가 매우 위험할 수 있다. 이러한 문제는 최근에 사회적 큰 이슈가 되기 때문에 안드로이드 코드 보안에 유의해야 한다. 이 논문에서는 안드로이드 코드 난독화의 동향과 안드로이드에서 제공하는 프로가드의 기술에 대해서 알아보고 프로가드의 한계에 대해서 파악한 후 향후 안드로이드 코드 난독화 개선 방법에 대해서 알아본다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.5
• /
• pp.1209-1223
• /
• 2018

Android apps are made up of bytecode, so they are vulnerable to reverse engineering, and protection services are emerging that robustly repackage the app to compensate. Unlike cryptographic algorithms, the robustness of these protection services depends heavily on hiding the protection scheme. Therefore, there are few systematic discussions about the protection method even if destruction techniques of the protection service are various. And it is implemented according to the intuition of the developer. There is a need to discuss systematic protection schemes for robust security chains, rather than simple deployment of techniques disrupting static or dynamic analysis. In this paper, we analyze bangcle, a typical commercial Android app protection service, to examine the protection structure and vulnerable elements. We propose the requirements for robust structure and principles of protection structure.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.6
• /
• pp.1049-1055
• /
• 2013

Smartphones are rapidly growing because of easy installation of the apps (application software) that users actually want. There are increasingly many apps that require cryptographic suites to be installed, for instance, for protecting account and financial data. Android platform provides protection mechanisms for memory and storage based on Linux kernel, but they are vulnerable to rooting attacks. In this paper, we analyze security mechanisms of Android platform and point out security problems. We show the security vulnerabilities of several commercial apps and suggest appropriate countermeasures.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2014.01a
• /
• pp.83-87
• /
• 2014

본 논문에서는 안드로이드 스마트폰 환경에서 높은 점유율을 가진 카카오톡 모바일 메신저 앱에 대하여 행정안전부가 고시한 Android-JAVA 시큐어 코딩가이드의 입력 데이터 검증 및 표현, API악용, 보안특성, 시간 및 상태, 에러처리, 코드 품질, 캡슐화 등 18가지 보안 취약점을 분석하고, 해당 취약점에 대한 시큐어 코딩 기법을 적용한다. 먼저 현재 상용화되고 있는 카카오톡 모바일 메신저 코드를 역공학(리버스엔지니어링)방법을 이용하여 코드단에서 소스를 분석한다. 실제 코드에서 시큐어 코딩이 안드로이드 스마트폰 환경에서 행정안전부가 고시한 Android-JAVA 시큐어 코딩가이드를 기준으로 취약한 부분을 찾고, 적용이 안 되어 있는 부분에 안드로이드 환경에 맞는 시큐어 코딩 기법을 적용한다.

• Journal of Software Assessment and Valuation
• /
• v.17 no.1
• /
• pp.41-50
• /
• 2021

Many game and financial apps have emulator detection functionality to defend against dynamic reverse engineering attacks. However, existing Android emulator detection methods have limitations in detecting the latest mobile game emulators that are similar to actual devices. Therefore, in this paper, we propose a method to effectively detect Android emulators for mobile games based on Houdini module and strings of a library. The proposed method detects the two emulators, Nox and LD Player through specific strings included in libc.so of bionic, and an analysis of the system call execution process and memory mapping associated with the Houdini module.

• Journal of Internet Computing and Services
• /
• v.20 no.2
• /
• pp.61-68
• /
• 2019

Although the number of smartphone users is continuously increasing due to the advantage of being able to easily use most of the Internet services, the number of counterfeit applications is rapidly increasing and personal information stored in the smartphone is leaked to the outside. Because Android app was developed with Java language, it is relatively easy to create counterfeit apps if attacker performs the de-compilation process to reverse app by abusing the repackaging vulnerability. Although an obfuscation technique can be applied to prevent this, but most mobile apps are not adopted. Therefore, it is fundamentally impossible to block repackaging attacks on Android mobile apps. In addition, personal information stored in the smartphone is leaked outside because it does not provide a forgery self-verification procedure on installing an app in smartphone. In order to solve this problem, blockchain is used to implement a process of certificated application registration and a fake app identification and detection mechanism is proposed on Hyperledger Fabric framework.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.4
• /
• pp.895-902
• /
• 2016

Smart phone distribution rate has been rising and it's security threat also has been rising. Especially Android smart phone reaches nearly 85% of domestic share. Since repackaging on android smart phone is relatively easy, the number of re-packaged malwares has shown steady increase. While many detection techniques have been proposed in order to prevent malwares, it is not easy to detect re-packaged malwares by static analysis and it is also difficult to operate dynamic analysis in android smart phone. Static analysis proposed in this paper features code reuse of repackaged malwares. We extracted DEX files from android applications and performed static analysis using class names and method names. This process doesn't not include reverse engineering, so it is possible to detect malwares efficiently.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.11a
• /
• pp.510-512
• /
• 2014

Malware Analysis tools are being main topic research for many mobile security companies, in this survey, we are trying to go through the most popular tools used to find out the malicious codes and suspected android programs through reverse engineering process. There are so many malware tools have been made and implemented and some of them are efficient enough and others are quite slow and consuming high processing, however we are going to compare briefly some of them.

• Journal of Korea Multimedia Society
• /
• v.19 no.10
• /
• pp.1792-1807
• /
• 2016

Android application is vulnerable to reverse engineering attack. And by this, it is easy to extract significant module from source code and repackage it. To prevent this problem, dynamic class loading technique, which is able to exclude running code from distributed source code and is able to load running code dynamically during runtime can be used. Recently, this technique was adapted on variety of fields and applications like updating pre-loaded android application, preventing from repacking malicious application, etc. Despite the fact that this technique is used on variety of fields and applications, there is fundamental lack on the study of potential weakness or related secure coding. This paper would deal with potential weaknesses during the implementation of dynamic class loading technique with analysing related international/domestic standard of weaknesses and suggest a secure way for the implementation of dynamic class loading technique. Finally, we believe that this technique described here could increase the level of trust by decreasing the weakness related to dynamic class loading technique.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.5
• /
• pp.1201-1215
• /
• 2015

Obfuscation tools can be used to protect android applications from reverse-engineering in android environment. However, obfuscation tools can also be misused to protect malicious applications. In order to evade detection of anti-virus, malware authors often apply obfuscation techniques to malicious applications. It is difficult to analyze the functionality of obfuscated malicious applications until it is deobfuscated. Therefore, a study on deobfuscation is certainly required to address the obfuscated malicious applications. In this paper, we analyze APKs which are obfuscated by commercial obfuscation tools and propose the deobfuscation method that can statically identify obfuscation options and deobfuscate it. Finally, we implement automatic identification and deobfuscation tool, then show the results of evaluation.