Title
Supporting transparent snapshot for bare-metal malware analysis on mobile devices
Document Type
Conference Paper/Presentation
Publication Date
12-2017
Abstract
The increasing growth of cybercrimes targeting mobile devices urges an efficient malware analysis platform. With the emergence of evasive malware, which is capable of detecting that it is being analyzed in virtualized environments, bare-metal analysis has become the definitive resort. Existing works mainly focus on extracting the malicious behaviors exposed during bare-metal analysis. However, after malware analysis, it is equally important to quickly restore the system to a clean state to examine the next sample. Unfortunately, state-of-the-art solutions on mobile platforms can only restore the disk, and require a time-consuming system reboot. In addition, all of the existing works require some in-guest components to assist the restoration. Therefore, a kernel-level malware is still able to detect the presence of the in-guest components. We propose Bolt, a transparent restoration mechanism for bare-metal analysis on mobile platform without rebooting. Bolt achieves a reboot-less restoration by simultaneously making a snapshot for both the physical memory and the disk. Memory snapshot is enabled by an isolated operating system (Bolt OS) in the ARM Trust-Zone secure world, and disk snapshot is accomplished by a piece of customized firmware (BoltFTL) for flash-based block devices. Because both theBoltOSand theBoltFTLare isolated from the guest system, even kernel-level malware cannot interfere with the restoration. More importantly, Bolt does not require any modifications into the guest system. As such, Bolt is the first that simultaneously achieves efficiency, isolation, and stealthiness to recover from infection due to malware execution. We have implemented aBoltprototype working with the Android OS. Experimental results showthatBoltcan restore the guest system to a clean state in only 2.80seconds.
Publication Title
ACSAC 2017 Proceedings of the 33rd Annual Computer Security Applications Conference
ISBN
978-1-4503-5345-8
Recommended Citation
Guan, L.,
Jia, S.,
Chen, B.,
Zhang, F.,
Luo, B.,
Lin, J.,
&
et. al.
(2017).
Supporting transparent snapshot for bare-metal malware analysis on mobile devices.
ACSAC 2017 Proceedings of the 33rd Annual Computer Security Applications Conference, 339-349.
http://doi.org/10.1145/3134600.3134647
Retrieved from: https://digitalcommons.mtu.edu/cs_fp/5
Publisher's Statement
© 2017 ACM.