Research on Multiple Detection Method Against Mascara Attack

Mascara is the first way to use virtualization technology to realize the virtualization customization of any Android application, and can effectively escape the attack of the current detection mechanism. The malicious application customized by Mascarer framework is an installable legal plug-in. The plug-in can extract sensitive information from the victim’s mobile phone by using the generated virtual environment, which is highly harmful. This paper proposes a detection method based on multiple analysis for Mascara attack. Based on the study of the principle of Mascara attack, aiming at the new anti detection mechanism of detecting and protecting the loading path of plug-in APK in its virtual environment, this method creatively puts forward and realizes the multiple progressive detection from virtual environment and dynamic loading to loading file. Firstly, check whether the target app generates the Android virtual environment by checking the field value of the data structure in the Android Runtime (ART) environment. If it has the generation behavior, use hook technology to further detect the dynamic loading APK behavior, and then extract the sensitive permission API of the loaded APK file through static analysis. Finally, a progressive scoring standard model is designed to provide a basis for further manual detection. The effectiveness of this method is verified by an example study.