Detecting repackaged android apps using server side analysis
A repackaged app is an original app that has been modified by an attacker to have some additional purpose. The attackers can get the app's source code using reverse engineering, and then insert malicious code before repackaging it. In this thesis, we focus on software based server side verification to detect repackaged Android apps. Based on the background of reverse engineering techniques and current preventing techniques, we propose a two phase model by improving existing detection schemes and adding an analysis phase. This analysis enable the server only analysis of an app's behavior. In the detection phase, we improve an attestation scheme by using hidden channel and dynamic code injection techniques in order to detect known attacks, especially dummy folder attacks. In the analysis phase, we design and implement an experiment to find an feasible method to distinguish repackaged applications and original applications. It is based on calculating distance between HTTP traffics sets.