Explaining the Use of Cryptographic API in Android Malware

Abstract

Cryptography allows for guaranteeing secure communications, concealing critical data from reverse engineering, or ensuring mobile users’ privacy. Android malware developers extensively leveraged cryptographic libraries to obfuscate and hide malicious behavior. Various system-based and third-party libraries provide cryptographic functionalities for Android, and their use and misuse by application developers have already been documented. This paper analyzes the use of cryptographic APIs in Android malware by comparing them to benign Android applications. In particular, Android applications released between 2012 and 2020 have been analyzed, and more than 1 million cryptographic API expressions have been gathered. We created a processing pipeline to produce a report to reveal trends and insights on how and why cryptography is employed in Android malware. Results showed that the usage of cryptographic APIs in malware differs from that made in benign applications. The different patterns in the use of cryptographic APIs in malware and benign applications have been further analyzed through the explanations of Android malware detectors based on machine learning approaches, showing how crypto-related features can improve detection performances. We observed that the transition to more robust cryptographic techniques is slower in Android malware than in benign applications.

A Detailed Comparison of Symmetric Ciphers Between Androzoo-M12 and CryptoLint-B12

Table 6 displays an in-depth comparison between symmetric encryption schemes in the datasets CryptoLint-B12 and Androzoo-M12. It should be stressed that even though the absolute number of call sites in CryptoLint-B12 is higher ($15\, 598$) than in Androzoo-M12 (9729), this comparison is severely skewed by the overall distribution characteristics of CryptoLint-B12 vs. Androzoo-M12. In other words, it takes 145 thousand of benign applications (where only each fifth call originates from user-defined codebase) to get 15 thousand calls, whereas 34 thousand of malicious applications would provide a similar number of symmetric encryption API call sites.

Table 6. Comparison of distribution of symmetric encryption schemes in malicious vs. benign applications (Androzoo-M12 and CryptoLint-B12). The frequency of malicious encryption schemes was normalized to fit the size of the benign dataset. In the benign set, only the schemes with frequency $>100$ were taken. There is no prevalent malicious scheme (freq. $>100$) that would not appear in the benign dataset. The default schemes marked with * symbol fall back into the ECB mode with PKCS7 padding.