Repack Me If You Can: An Anti-Repackaging Solution Based on Android Virtualization
Antonio Ruggia, Eleonora Losiouk, Luca Verderame, Mauro Conti, Alessio Merlo · Annual Computer Security Applications Conference · 2021
A growing trend in repackaging attacks exploits the Android virtualization technique, in which malicious code can run together with the victim app in a virtual container. In such a scenario, the attacker can directly build a malicious container capable of hosting the victim app instead of tampering with it, thus neglecting any anti-repackaging protection developed so far. Also, existing anti-virtualization techniques are ineffective since the malicious container can intercept - and tamper with - such controls at runtime. So far, only two solutions have been specifically designed to address virtualization-based repackaging attacks. However, their effectiveness is limited since they both rely on static taint analysis, thus not being able to evaluate code dynamically loaded at runtime.