Presentation Title Mobile Malware Analysis
Presentation Abstract

Mobile malware is becoming a larger concern every day, as the proliferation of smartphones continues and more and more in-the-wild malicious applications appear. Unfortunately, many people charged with malware analysis and/or network defense lack the tools or the know-how to analyze malicious binaries on anything but a standard Windows/x86 environment – and thus mobile malware remains shrouded in mystery, with inadequate response compared to traditional desktop-based malware.

This presentation aims to combat that problem. I’ll explain the process of setting up a virtual machine capable of running and analyzing Android applications (chosen as the mobile platform most likely to see new malware), and then step through analysis of live samples collected from the wild. The analysis will focus primarily on network behavior that can be used to detect infected devices – something whose usefulness is not limited to cell phone carriers, given the number of mobile devices that communicate over local Wi-Fi networks.

About Alex Kirk

Alex Kirk is a senior member of the Sourcefire VRT, and has been involved in vulnerability analysis and detection since starting there in 2004. He currently runs the VRT’s malware zoo, which has produced over 1TB worth of packet capture data by running live samples from the ClamAV virus database. He is the author of a pair of Snort-related chapters in the 2009 book “Practical Intrusion Analysis: Prevention and Detection for the Twenty-First Century,” is a regular contributor to the VRT blog (http://vrt-blog.snort.org/), and routinely speaks at security conferences around the world on IDS-related topics.