Can I read VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics on EtoBox?

VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics by Jennifer Bellizzi; Eleonora Losiouk; Mauro Conti; Christian Colombo; Mark Vella is a Computer Science article available to read on EtoBox.

What is VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics about?

The ubiquity of Android smartphones makes them targets of sophisticated malware, which maintain long-term stealth, particularly by offloading attack steps to benign apps. Such malware leaves little to no trace in logs, and the attack steps become difficult to discern from benign app functionality. Endpoint detection and response (EDR) systems provide live forensic capabilities that enable anomaly detection techniques to detect anomalous behavior in application logs after an app hijack. However, this presents a challenge, as state-of-the-art EDRs rely on device and third-party application logs, which may not include evidence of attack steps, thus prohibiting anomaly detection techniques from exposing anomalous behavior. While, theoretically, all the evidence resides in volatile memory, its ephemerality necessitates timely collection, and its extraction requires device rooting or app repackaging. We present VEDRANDO, an enhanced EDR for Android that accomplishes (i) the challenge of timely collection of volatile memory artefacts and (ii) the detection of a class of stealthy attacks that hijack benign applications. VEDRANDO leverages memory forensics and app virtualization techniques

Who reads VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics?

Author

Jennifer Bellizzi; Eleonora Losiouk; Mauro Conti; Christian Colombo; Mark Vella

Publisher

MDPI AG

Published

2023

Language

EN

Field

Computer Science (Physical Sciences)