Delivering malicious Android apps hidden in image files

Researchers have found a way to deliver a malicious app to Android users by hiding it into what seems to be an encrypted image file, which is then delivered via a legitimate, seemingly innocuous wrapper app.

Fortinet malware researcher Axelle Apvrille and reverse engineer Ange Albertini devised the attack and demonstrated it last week at the Black Hat Europe conference in Amsterdam.

To pull it off, they had to create a custom tool they dubbed AngeCryption, which allows them to encrypt the payload Android application package (APK) and make it look like an image (PNG, JPG) file .

They also had to create another APK that carries the “booby-trapped” image file and which can decrypt it to unveil the malicious APK file and install it.

A malicious app thusly encrypted is nearly invisible to reverse engineers, and possibly even to AV solutions and Google’s Android Bouncer.

AngeCryption, in the form of a Python script, is available for download here, and the slides from the researchers’ presentation and their paper offer more technical details about how it and the attack works.

In their testing, Android did show a permission request when the legitimate wrapper file tried to install the malicious APK, but the researchers say that this can be prevented by using DexClassLoader.

They also pointed out how this attack can work, i.e. the app in question can be loaded, only if some data can be appended after the End of Central Directory (EOCD) zip marker. This change is accepted only because they added another EOCD after the additional data.

The attack works with any payload and currently on any version of Android, and the Android Security Team has been notified of it and is currently working on a definite fix.