Mobile malware analysis for penny-pinchers

A GSM network replication jail has been created for about $1000 that removes limitations on testing mobile malware.

Fortinet senior anti-virus researcher Axell Apvrille said the jail allowed mobile malware to function as normal over GSM networks and eliminated the risk of it spreading to other devices.

It was also cheaper than other methods of malware testing, according to Apvrille.

“Basically, the idea for this mobile malware jail is to create a standalone local GSM operator for a few test phones and without any connection to the external world ... there is no risk of contaminating, damaging or disrupting anything other than those test phones,” Apvrille said in a paper (pdf).

“Most solutions have shown big drawbacks.”

According to Apvrille, removing SIM cards to prevent the spread of malware was ineffective because it could prevent normal phone operation and did not block wireless and Bluetooth services.

Activating airport mode disrupted the normal operation of malware and could allow programs to reactivate data services.

Large Faraday cages which restrict mobile signals such as that used at the Berlin Institute of Technology (pdf) were generally impractical and expensive.

Virtual machines were problematic too, Apville said. Emulators for Android and Java allowed malware to run but without GSM access which she said deforms behaviour. She said Symbian emulators did not exist and the web-based iPhone simulator could not be used to test malware.

Finally, she said an architecture based on OpenBSC and nanoBTS was up to six times as expensive as Apvrille’s model based on Universal Software Peripheral Radio (USRP) hardware and the OpenBTS open source software.

OpenBTS architecture

The model included a standard Linux host that ran Asterisk and OpenBTS, attached to a USRP 1 motherboard and daughterboard which emitted GSM frequencies.

Several malware samples were tested with “good results” Apvrille said, although some malware such as those affecting Apple iPhones, Windows mobile and Blackberry were not examined due to limitations of samples.

Samples that required internet access via a WCDMA bearer as opposed to a Wi-Fi access point had failed and were unable to be fully tested.

A detailed analysis is available in Apvrille’s paper An OpenBTS Replication Jail for Mobile Malware.

Copyright © SC Magazine, Australia