ApkScan beta released

Yesterday we released the first version of ApkScan! For those who can’t wait to run some of your Android applications through the scanners, ApkScan can be found at http://apkscan.nviso.be/. Two example reports generated by ApkScan can be found here and here. More details after the screenshot.

As we mentioned during a previous blog post, ApkScan allows you to scan Android packages for malicious activity. For this analysis, we use a combination of static and dynamic scanning techniques. Although we are planning on continuously adding and improving existing and new scanning methods, the current version of ApkScan already performs the following analysis:

 Static analysis

  • Analysis of AndroidManifest.xml
    • Registered permissions
    • Registered services
  • Analysis of disassembled source code
    •   Extract hard-coded URL’s

Dynamic analysis

  • Behavioral analysis using Droidbox
    • Behavior graphs
    • Placed phone calls
    • Sent SMS messages
    • Cryptographic activity
    • Information leakage (network / SMS / file)

External services

  • Virus scan of original samples using the VirusTotal API
  • URL scan of hard-coded URL’s using Google Safe Browsing API

In order to support these scanning features, we have implemented our own ApkScan API client. This client fetches the uploaded samples in a BackTrack machine, and analyses and runs the samples in a sandboxed environment.

We look forward to your feedback and suggestions! We will be posting more updates soon so keep an eye out on this blog!
 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s