Abstract
Trojan droppers consistently emerge as challenging malware threats, particularly within the Android ecosystem. Traditional malware detection approaches focus on identifying payloads upon execution or intercepting malicious downloads from compromised sources. Despite efforts to harden network defenses against such droppers, malicious threat actors keep exploring unconventional infiltration approaches. This study expands on covert channel attacks, proposing the use of gaming platforms, like the classic Tetris arcade game, as a novel vector for malicious payload delivery. Our methodology diverges from conventional network-based attacks by embedding malicious payloads within the game’s Tetromino pieces. Through a custom-made application that masquerades as a benign Tetris variant, we deliver and execute malicious payloads on target devices within 3 to 7 min. This is achieved by combining the Shikata-Ga-Nai polymorphic encoder, an autosuggestion algorithm, and mapping Tetromino blocks to a Meterpreter payload to innovatively deliver malicious payloads via gameplay suggestions. Our work provides a novel covert channel attack which merges gamification with malicious payload delivery. To the best of our knowledge, this is the first study that introduces gamification and autosuggestion mechanisms for payload delivery. We present an in-depth analysis of the proposed attack, along with a number of countermeasures to mitigate such threats, emphasizing the importance of enhanced user awareness and human oversight during dynamic malware analysis.


















Similar content being viewed by others
Data availability
All data generated or analyzed during this study are included in this published article.
References
Check Point. Mobile Security Report 2021. Check Point. (2021). https://pages.checkpoint.com/mobile-security-report-2021.html
Verizon. 2023 Mobile Security Index Report. Verizon. (2023). https://www.verizon.com/business/resources/reports/mobile-security-index-report.pdf
Malwarebytes. Trojan Dropper. https://www.malwarebytes.com/blog/detections/trojan-dropper
Malwarebytes. Navigating mobile malware trends: Crucial insights and predictions for MSPs. Malwarebytes. (2023). https://www.malwarebytes.com/blog/business/2023/05/navigating-mobile-malware-trends-crucial-insightsand-predictions-for-msps
Malwarebytes. 2023 State of Malware report. Malwarebytes. (2023). https://try.malwarebytes.com/2023-state-of-malwaretyp-dl/
Monica Anderson. Many smartphone owners don’t take steps to secure their devices. Pew Research Center. 2017. https://www.pewresearch.org/short-reads/2017/03/15/many-smartphone-owners-dont-take-steps-to-secure-their-devices/
Luo, W., Huang, F., Huang, J.: Edge adaptive image steganography based on LSB matching revisited. IEEE Trans. Inf. Forensics Secur. 5(2), 201–214 (2010). https://doi.org/10.1109/TIFS.2010.2041812
Zhang, L., Wang, H., Wu, R.: A high-capacity steganography scheme for JPEG2000 baseline system. IEEE Trans. Image Process. 18(8), 1797–1803 (2009). https://doi.org/10.1109/TIP.2009.2021544
Lee, J. H., and Wu, M. Y. : A reversible data hiding method for palette-based images with capacity optimization . In: Arabnia, H. R. (ed) Proceedings of the 2008 International Conference on Image Processing, Computer Vision, & Pattern Recognition, IPCV 2008, Las Vegas Nevada, USA, 2 Volumes. CSREA Press, pp. 95–100 (2008)
Ni, Z., et al.: Reversible data hiding. IEEE Trans. Circuits Syst. Video Technol. 16(3), 354–362 (2006). https://doi.org/10.1109/TCSVT.2006.869964
Chen, Y.-S., Wang, R.-Z.: Steganalysis of reversible contrast mapping watermarking. IEEE Signal Process. Lett. 16(2), 125–128 (2009). https://doi.org/10.1109/LSP.2008.2008951
Gul, G., Kurugollu, F.: SVD-based universal spatial domain image steganalysis. IEEE Trans. Inf. Forensics Secur. 5(2), 349–353 (2010). https://doi.org/10.1109/TIFS.2010.2041826
Zhang, J., Zhang, D.: Detection of LSB Matching Steganography in Decompressed Images. IEEE Signal Process. Lett. 17(2), 141–144 (2010). https://doi.org/10.1109/LSP.2009.2035379
Ashwaq, A., et al.: Permission vs. app limiters: profiling smartphone users to understand differing strategies for mobile privacy management . In: Barbosa, S. D. J. et al. (eds) CHI ’22: CHI Conference on Human Factors in Computing Systems, New Orleans, 29 April 2022 - 5 May 2022. ACM, 2022, 406:1- 406:18. https://doi.org/10.1145/3491102.3517652
Oberheide, J., Miller, C.: Dissecting the android bouncer. In: SummerCon2012, New York 95, 110 (2012)
Priyam, P., et al.: On the effectiveness of random testing for Android: or how i learned to stop worrying and love the monkey . In: Bai, X., Jenny Li, J., Ulrich, A. (eds) Proceedings of the 13th International Workshop on Automation of Software Test, AST@ICSE 2018, Gothenburg, Sweden, 2018. ACM, 2018, pp. 34-37. https://doi.org/10.1145/3194733.3194742
Blake Montgomery. Oklahoma 13-year-old believed to be first person ever to beat Tetris. The Guardian. 2024. https://www.theguardian.com/technology/2024/jan/03/oklahoma-teen-beat-tetris-first-personwillis-gibson
Swarup, C., et al.: Towards a systematic study of the covert channel attacks in smartphones . In: Tian, J., Jing, J., Srivatsa, M. (eds) International Conference on Security and Privacy in Communication Networks - 10th International ICST Conference, SecureComm 2014, Beijing, China, 2014, Revised Selected Papers, Part I. Vol. 152. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering. Springer, 2014, pp. 427-435 https://doi.org/10.1007/978-3-319-23829-6_29
Okhravi, H., Bak, S., King, S. T.: Design, implementation and evaluation of covert channel attacks. In: IEEE International Conference on Technologies for Homeland Security (HST). IEEE. 2010, 481–487 (2010)
Computer Security Resource Center (CSRC). Covert channel. National Institute of Standards and Technology (NIST). (2024). https://csrc.nist.gov/glossary/term/covert channel
Anderson, R.J., Petitcolas, F.A.P.: On the limits of steganography. IEEE J. Sel. Areas Commun. 16(4), 474–481 (1998). https://doi.org/10.1109/49.668971
Johnson, N.F., Jajodia, S.: Exploring Steganography: seeing the Unseen. Computer 31(2), 26–34 (1998). https://doi.org/10.1109/MC.1998.4655281
Serdar, C., Brodley, C. E., Clay, S.: IP covert timing channels: design and detection. In: Atluri, V., Pfitzmann, B., McDaniel, P. D. (eds) Proceedings of the 11th ACM Conference on Computer and Communications Security, CCS 2004, Washington, 2004. ACM, 2004, pp. 178–187. https://doi.org/10.1145/1030083.1030108
Yuanzhang, L., et al.: A robust packet-dropping covert channel for mobile intelligent terminals. Int. J. Intell. Syst. 37(10), 6928–6950 (2022). https://doi.org/10.1002/INT.22868
Han, J., et al.: Covert timing channel detection method based on time interval and payload length analysis. Comput. Secur. 97, 101952 (2020). https://doi.org/10.1016/J.COSE.2020.101952
Kevin, L., Jana, D.: Covert channels in network time security. In: Manjunath, B. S. et al. (eds) IH &MMSec ’22: ACM Workshop on Information Hiding and Multimedia Security, Santa Barbara, 2022. ACM, 2022, pp. 69–79. https://doi.org/10.1145/3531536.3532947
Jie, L., et al.: A timestamp-based covert data transmission method in industrial control system. In: 7th IEEE International Conference on Data Science in Cyberspace, DSC 2022, Guilin, China, 2022. IEEE, 2022, pp. 526–532. https://doi.org/10.1109/DSC55868.2022.00079
Yunjing, X., et al.: An exploration of L2 cache covert channels in virtualized environments . In: Cachin, C., Ristenpart, T. (eds) Proceedings of the 3rd ACM Cloud Computing Security Workshop, CCSW 2011, Chicago, 2011. ACM, 2011, pp. 29–40. https://doi.org/10.1145/2046660.2046670
Clémentine, M., et al.: C5: Cross-cores cache covert channel. In: Almgren, M., Gulisano, V., Maggi, F. (eds) Detection of Intrusions and Malware, and Vulnerability Assessment - 12th International Conference, DIMVA 2015, Milan, Italy, Proceedings, Vol. 9148. Lecture Notes in Computer Science. Springer, 2015, pp. 46–64. https://doi.org/10.1007/978-3-319-20550-2_3https://doi.org/10.1007/978-3-319-20550-2%5C_3
Stergiopoulos, G., et al.: Dropping malware through sound injection: a comparative analysis on Android operating systems. Comput. Secur. 105, 102228 (2021). https://doi.org/10.1016/J.COSE.2021.102228
Guri, M., Solewicz, Y.A., Elovici, Y.: Fansmitter: acoustic data exfiltration from air-Gapped computers via fans noise. Comput. Secur. 91, 101721 (2020). https://doi.org/10.1016/J.COSE.2020.101721
Guri, M.: Optical air-gap exfiltration attack via invisible images. J. Inf. Secur. Appl. 46, 222–230 (2019). https://doi.org/10.1016/J.JISA.2019.02.004
Mordechai, G.: Optical covert channel from air-gapped networks via remote orchestration of router/switch LEDs . In: Brynielsson, J. (ed) European Intelligence and Security Informatics Conference, EISIC 2018, Karlskrona, Sweden, 2018. IEEE, 2018, pp. 54–60. https://doi.org/10.1109/EISIC.2018.00016
Guri, M.: Exfiltrating data from airgapped computers via ViBrAtIoNs. Future Gener. Comput. Syst. 122, 69–81 (2021). https://doi.org/10.1016/J.FUTURE.2021.03.025
Guri, M., Zadov, B., Elovici, Y.: ODINI: escaping sensitive data from Faraday- caged, air-gapped computers via magnetic fields. IEEE Trans. Inf. Forensics Secur. 15, 1190–1203 (2020). https://doi.org/10.1109/TIFS.2019.2938404
Mordechai, G., Andrey, D., Yuval, E.: MAGNETO: covert channel between air-gapped systems and nearby smartphones via CPU-generated magnetic fields. In: CoRR abs/1802.02317 (2018). arXiv: 1802.02317
Mordechai, G., et al.: BitWhisper: covert signaling channel between air-gapped computers using thermal manipulations . In: CoRR abs/1503.07919 (2015). arXiv: 1503.07919
Mordechai, G.: HOTSPOT: crossing the air- gap between isolated PCs and nearby smartphones using temperature. In: European Intelligence and Security Informatics Conference, EISIC 2019, Oulu, Finland, November 26-27, 2019. IEEE (2019), pp. 94–100. https://doi.org/10.1109/EISIC49498.2019.9108874
Guri, M.: AIR-FI: leaking data from air-gapped computers using Wi-Fi frequencies. IEEE Trans. Depend. Secur. Comput. 20(3), 2547–2564 (2023). https://doi.org/10.1109/TDSC.2022.3186627
Mordechai, G.: RAMBO: Leaking secrets from air-gap computers by spelling covert radio signals from Computer RAM. In: Fritsch, L., Hassan, I., Paintsil, E. (eds) Secure IT Systems - 28th Nordic Conference, NordSec 2023, Oslo, Norway, 2023, Proceedings. Vol. 14324. Lecture Notes in Computer Science. Springer, 2023, pp. 144–161. https://doi.org/10.1007/978-3-031-47748-5_9
César, J., Castro, H., et al.: Steganography in games: a general methodology and its application to the game of Go. Comput. Secur. 25(1), 64–71 (2006). https://doi.org/10.1016/J.COSE.2005.12.001
Farn, E.-J., Chen, C.-C.: Novel steganographic method based on jig swap puzzle images. J. Electron. Imaging 18(1), 013003 (2009). https://doi.org/10.1117/1.3073979
Farn, E.-J., Chen, C.-C.: Jigsaw puzzle images for steganography. Opt. Eng. 48(7), 077006 (2009)
Zhan-He, O., Chen, L.-H.: A steganographic method based on tetris games. Inf. Sci. 276, 343–353 (2014). https://doi.org/10.1016/J.INS.2013.12.024
Desoky, A., Younis, M.F.: Chestega: chess steganography methodology. Secur. Commun. Netw. 2(6), 555–566 (2009). https://doi.org/10.1002/SEC.99
Lee, H.-L., Lee, C.-F., Chen, L.-H.: A perfect maze based steganographic method. J. Syst. Softw. 83(12), 2528–2535 (2010). https://doi.org/10.1016/J.JSS.2010.07.054
Philip C., Ritchey., Vernon, R.: Covert channels in combinatorial games. In: Riley, G. F., Quaglia, F., Himmelspach, J. (eds) International ICST Conference on Simulation Tools and Techniques, SIMUTOOLS ’12, Sirmione- Desenzano, Italy, 2012. ICST/ACM, 2012, pp. 234–241. https://doi.org/10.4108/ICST.SIMUTOOLS.2012.247733
Mahato, S., Kumar Yadav, D., Ali Khan, D.: A minesweeper game-based steganography scheme. J. Inf. Secur. Appl. 32, 1–14 (2017). https://doi.org/10.1016/J.JISA.2016.11.005
Susmita, M.: Snake-Stega: A snake gamebased steganography scheme. In: 2023 Third International Conference on Secure Cyber Computing and Communication (ICSCCC). IEEE (2023), pp. 167-171
ŞATIR, E., Güner, K.: A snake game steganography method based on S-boxes. Düzce Üniversitesi Bilim ve Teknoloji Dergisi 5(1), 193–209 (2017)
Qi, W., et al.: Construction and mitigation of user-behavior-based covert channels on smartphones. IEEE Trans. Mob. Comput. 17(1), 44–57 (2018). https://doi.org/10.1109/TMC.2017.2696945
Efthimios, A., Constantinos, P.: Hey doc, is this normal?: exploring android permissions in the post marshmallow era. In: Ali, S. S., Danger, J. L., Eisenbarth, T. (eds) Security, Privacy, and Applied Cryptography Engineering - 7th International Conference, SPACE 2017, Proceedings. Vol. 10662. Lecture Notes in Computer Science. Springer, 2017, pp. 53–73. https://doi.org/10.1007/978-3-319-71501-8_4
Adrienne, P. F., et al.: Android permissions: user attention, comprehension, and behavior. In: Cranor L. F. (ed) Symposium On Usable Privacy and Security, SOUPS ’12, Washington, 2012. ACM, 2012, p. 3.https://doi.org/10.1145/2335356.2335360
Alexios, M., et al.: A Qualitative metrics vector for the awareness of smartphone security users . In: Furnell, S., Lambrinoudakis, C., López, J. (eds) Trust, Privacy, and Security in Digital Business - 10th International Conference, TrustBus 2013, Prague, Czech Republic, 2013. Proceedings. Vol. 8058. Lecture Notes in Computer Science. Springer, 2013, pp. 173–184. https://doi.org/10.1007/978-3-642-40343-9_15
Mylonas, A., Kastania, A., Gritzalis, D.: Delegate the smartphone user? Security awareness in smartphone platforms. Comput. Secur. 34, 47–66 (2013). https://doi.org/10.1016/J.COSE.2012.11.004
Michael. How to hack android mobile device remotely using metasploit framework. https://shell-terminal.medium.com/how-to-hackandroid-mobile-device-remotely-using-metasploit-framework-db7ba2f6a27b
Will, G., John, P.: Cybercrime and espionage: an analysis of subversive multi-vector threats. Newnes (2011)
Ryan., F., Xinyuan, W.: CodeXt: automatic extraction of obfuscated attack code from memory dump. In: Chow, S. S. M. et al. (eds) Information Security - 17th International Conference, ISC 2014, Hong Kong, China, 2014. Proceedings. Vol. 8783. Lecture Notes in Computer Science. Springer, 2014, pp. 502–514. https://doi.org/10.1007/978-3-319-132570_32
Rapid 7. Polymorphic XOR Additive Feedback Encoder. https://www.rapid7.com/db/modules/encoder/x86/shikata_ga_nai/
Donald, E. K.: The art of computer programming, sorting and searching, Volume III, 2nd Edition. Addison-Wesley (1998). isbn: 0201896850. https://www.worldcat.org/oclc/312994415
Thomas., H., Cormen, et al.: Introduction to Algorithms. MIT Press (2022)
Peter, D.: Rfc1951: Deflate compressed data format specification version 1.3. Tech. rep. (1996)
Peter, D.: GZIP file format specification version 4.3. Tech. rep. (1996)
Tetris, W.: TGM randomizer. Tetris Fandom. https://tetris.fandom.com/wiki/TGM_randomizer%7D
Nick, T., et al.: A taxonomy of side channel attacks on critical infrastructures and relevant systems . In: Critical Infrastructure Security and Resilience: Theories, Methods, Tools and Technologies (2019), pp. 283–313
Gritzalis, D., et al.: Exiting the risk assessment maze: a meta-survey. ACM Comput. Surv. 51(1), 11:1-11:30 (2018).https://doi.org/10.1145/3145905
Bhandari, S., et al.: SWORD: semantic aWare andrOid malwaRe detector. J. Inf. Secur. Appl. 42, 46–56 (2018). https://doi.org/10.1016/J.JISA.2018.07.003
Surendran, R., Thomas, T., Emmanuel, S.: GSDroid: graph signal based compact feature representation for android malware detection. Expert Syst. Appl. 159, 113581 (2020). https://doi.org/10.1016/J.ESWA.2020.113581
Jan, S., et al.: Integrity verification and behavioral classification of a large dataset applications pertaining smart OS via blockchain and generative models. Expert Syst. J. Knowl. Eng. 38, 4 (2021). https://doi.org/10.1111/EXSY.12611
Papadopoulos, H., et al.: Android malware detection with unbiased confidence guarantees. Neurocomputing 280, 3–12 (2018). https://doi.org/10.1016/J.NEUCOM.2017.08.072
Feng, P., et al.: A novel dynamic android malware detection system with ensemble learning. IEEE Access 6, 30996–31011 (2018). https://doi.org/10.1109/ACCESS.2018.2844349
Jerbi, M., et al.: On the use of artificial malicious patterns for android malware detection. Comput. Secur. 92, 101743 (2020). https://doi.org/10.1016/J.COSE.2020.101743
Puerta, J.G., et al.: Detecting malicious Android applications based on the network packets generated. Neurocomputing 456, 629–636 (2021). https://doi.org/10.1016/J.NEUCOM.2020.08.095
D’Angelo, G., Ficco, M., Palmieri, F.: Malware detection in mobile environments based on Autoencoders and API-images. J. Parallel Distrib. Comput. 137, 26–33 (2020). https://doi.org/10.1016/J.JPDC.2019.11.001
Abada. A., et al.: Android Malware detection based on system calls analysis and CNN classification. In: 2019 IEEE Wireless Communications and Networking Conference Workshop, WCNC Workshops 2019, Marrakech, Morocco, April 15–18, 2019. IEEE, 2019, pp. 1–6. https://doi.org/10.1109/WCNCW.2019.8902627. url: https://doi.org/10.1109/WCNCW.2019.8902627
James, T., Thomas, B., David, B.: Practical lossless compression with latent variables using bits back coding. In: 7th International Conference on Learning Representations, ICLR 2019, New Orleans (2019). OpenReview.net, 2019. https://openreview.net/forum?id=ryE98iR5tm
James, T., Thomas, B., David, B.: Practical lossless compression with latent variables using bits back coding . In: 7th International Conference on Learning Representations, ICLR 2019, New Orleans (2019). OpenReview.net (2019). https://openreview.net/forum?id=ryE98iR5tm
Jarek, D.: Asymmetric numeral systems. In: CoRR abs/0902.0271 (2009). arXiv: 0902.0271
Kaspersky.: Kaspersky discloses iPhone hardware feature vital in Operation Triangulation case. Kaspersky. https://www.kaspersky.com/about/press-releases/2023_kasperskydiscloses- iphone-hardware-feature-vitalin- operation-triangulation-case%7D
Zack, W.: Russian malware controls hiding in plain sight -on Britney Spears’ Instagram page. ZDNET. https://www.zdnet.com/article/russian-malware-controls-hiding-in-plain-sight-on-britney-spears-instagram-account/%7D
Catalin, C.: Russian state hackers use britney spears instagram posts to control Malware. BleepingComputer. https://www.bleepingcomputer.com/news/security/russian-state-hackers-use-britney-spears-instagram-posts-to-control-malware/%7D
Android. Cloud-based protections. Google. url: https://developers.google.com/android/play-protect/cloud-based-protections%7D
Author information
Authors and Affiliations
Corresponding author
Ethics declarations
Conflict of interest
None of the authors have received a speaker honorarium from any company. All authors declare that none of them has any Conflict of interest.
Ethical approval
This article does not contain any studies with animals performed by any of the authors.
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.
About this article
Cite this article
Vasilellis, E., Botsos, V., Anagnostopoulou, A. et al. Gaming the system: tetromino-based covert channel and its impact on mobile security. Int. J. Inf. Secur. 23, 3007–3027 (2024). https://doi.org/10.1007/s10207-024-00875-3
Published:
Issue Date:
DOI: https://doi.org/10.1007/s10207-024-00875-3