Malware forensics on mobile devices for DOE-EM applications - 15708
Malware attacks are deployed in order to achieve one of the following goals: To disrupt system functionality; To gather sensitive information; To gain access to private data. The top areas that become primary targets for malware to attack are: Availability, Integrity, Confidentiality. Malware forensics is a particular field where the execution and methods of a malware are studied. Malware activity has increased on unprotected mobile devices. Establishing an accurate and ethical approach is critical when assessing security issues. Knowing the method of execution leads to fewer security risks and prevention of future attacks. Our intentions are not to create a new wave of malware attacks, but to study them and point to possible vulnerabilities that can occur. To create a work-flow for desktop computers, the following benchmarks are used: Using an isolated environment, tracing the host processes, using dynamic analysis to isolate the malware and destroy it. The isolated environment will prevent any malignant code from activating and risking the rest of the computers in the vicinity and/or network. Tracing the host processes, will allow us to read the host and user processes, giving us valuable information on the activities of the device. Using dynamic analysis will allow us to manipulate the malware in a number of ways, such as using a debugger to try and change it. We used a virus and a Trojan to infiltrate a desktop computer for the following reasons: A - The virus will inject itself to force data to connect using a port. B - The Trojan will unlock and grant access to an unauthorized port. With the desktop work-flow in place as a systematic approach for mobile applications, we will investigate how to apply the same methods to the mobile devices. We are currently looking into different ways to develop 'friendly' malware to launch on the Android. We will then try to use malignant Windows malware to infect an Android, and using the work-flow try to come to the same conclusion as with the Android and Desktop, separately.