Hydra-Bite: Static Taint Immunity, Split, and Complot Based Information Capture Method for Android Device

Abstract EN

In order to attract attention to the malicious use of large-scale operation of applications, Hydra-Bite, an Android device privacy leak path implemented by splitting traditional malicious application and restructuring to a collaborative application group, is proposed in this paper.

For Hydra-Bite, firstly, traditional privacy stealing Trojan is analyzed to obtain the permission set.

And the permission set redundancy elimination splitting algorithm is subsequently adopted to extract the simplest key permission set and split the set by functions so as to form the collaborative application group.

Then, a covert channel is adopted for the intergroup Apps to remove the information’s taint tagged by security methods.

Meanwhile, a communication medium selection algorithm and an information normalization coding method are proposed to improve the efficiency and the concealing property for taints removal.

Finally, collaborative external transmission of information is realized on the basis of intragroup Apps’ communication.

The experimental results show that Hydra-Bite could resist the detecting and killing of about 60 security engines such as Kaspersky, McAfee, and Qihoo-360 in VirusTotal platform and capture the privacy information of the devices of different versions from Android 4.0 to Android 7.0.

Hydra-Bite can resist the killing of the following two methods, the typical detection tool Androguard based on “permission-API” and the typical static taint tracking tool FlowDroid.

Compared with traditional privacy stealing Trojan, Hydra-Bite has higher information capture rate and stronger antikilling performance.