Nothing Special   »   [go: up one dir, main page]

Skip to main content

Advertisement

Log in

Gaming the system: tetromino-based covert channel and its impact on mobile security

  • Regular Contribution
  • Published:
International Journal of Information Security Aims and scope Submit manuscript

Abstract

Trojan droppers consistently emerge as challenging malware threats, particularly within the Android ecosystem. Traditional malware detection approaches focus on identifying payloads upon execution or intercepting malicious downloads from compromised sources. Despite efforts to harden network defenses against such droppers, malicious threat actors keep exploring unconventional infiltration approaches. This study expands on covert channel attacks, proposing the use of gaming platforms, like the classic Tetris arcade game, as a novel vector for malicious payload delivery. Our methodology diverges from conventional network-based attacks by embedding malicious payloads within the game’s Tetromino pieces. Through a custom-made application that masquerades as a benign Tetris variant, we deliver and execute malicious payloads on target devices within 3 to 7 min. This is achieved by combining the Shikata-Ga-Nai polymorphic encoder, an autosuggestion algorithm, and mapping Tetromino blocks to a Meterpreter payload to innovatively deliver malicious payloads via gameplay suggestions. Our work provides a novel covert channel attack which merges gamification with malicious payload delivery. To the best of our knowledge, this is the first study that introduces gamification and autosuggestion mechanisms for payload delivery. We present an in-depth analysis of the proposed attack, along with a number of countermeasures to mitigate such threats, emphasizing the importance of enhanced user awareness and human oversight during dynamic malware analysis.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9
Fig. 10
Fig. 11
Fig. 12
Fig. 13
Fig. 14
Fig. 15
Fig. 16
Fig. 17
Fig. 18

Similar content being viewed by others

Explore related subjects

Discover the latest articles, news and stories from top researchers in related subjects.

Data availability

All data generated or analyzed during this study are included in this published article.

Notes

  1. https://media.ccc.de/v/37c3-11859-operation_triangulation_what_you_get_when_attack_iphones_of_researchers.

  2. https://developer.android.com/studio/test/other-testing-tools/monkey.

References

  1. Check Point. Mobile Security Report 2021. Check Point. (2021). https://pages.checkpoint.com/mobile-security-report-2021.html

  2. Verizon. 2023 Mobile Security Index Report. Verizon. (2023). https://www.verizon.com/business/resources/reports/mobile-security-index-report.pdf

  3. Malwarebytes. Trojan Dropper. https://www.malwarebytes.com/blog/detections/trojan-dropper

  4. Malwarebytes. Navigating mobile malware trends: Crucial insights and predictions for MSPs. Malwarebytes. (2023). https://www.malwarebytes.com/blog/business/2023/05/navigating-mobile-malware-trends-crucial-insightsand-predictions-for-msps

  5. Malwarebytes. 2023 State of Malware report. Malwarebytes. (2023). https://try.malwarebytes.com/2023-state-of-malwaretyp-dl/

  6. Monica Anderson. Many smartphone owners don’t take steps to secure their devices. Pew Research Center. 2017. https://www.pewresearch.org/short-reads/2017/03/15/many-smartphone-owners-dont-take-steps-to-secure-their-devices/

  7. Luo, W., Huang, F., Huang, J.: Edge adaptive image steganography based on LSB matching revisited. IEEE Trans. Inf. Forensics Secur. 5(2), 201–214 (2010). https://doi.org/10.1109/TIFS.2010.2041812

    Article  Google Scholar 

  8. Zhang, L., Wang, H., Wu, R.: A high-capacity steganography scheme for JPEG2000 baseline system. IEEE Trans. Image Process. 18(8), 1797–1803 (2009). https://doi.org/10.1109/TIP.2009.2021544

    Article  MathSciNet  Google Scholar 

  9. Lee, J. H., and Wu, M. Y. : A reversible data hiding method for palette-based images with capacity optimization . In: Arabnia, H. R. (ed) Proceedings of the 2008 International Conference on Image Processing, Computer Vision, & Pattern Recognition, IPCV 2008, Las Vegas Nevada, USA, 2 Volumes. CSREA Press, pp. 95–100 (2008)

  10. Ni, Z., et al.: Reversible data hiding. IEEE Trans. Circuits Syst. Video Technol. 16(3), 354–362 (2006). https://doi.org/10.1109/TCSVT.2006.869964

    Article  Google Scholar 

  11. Chen, Y.-S., Wang, R.-Z.: Steganalysis of reversible contrast mapping watermarking. IEEE Signal Process. Lett. 16(2), 125–128 (2009). https://doi.org/10.1109/LSP.2008.2008951

    Article  Google Scholar 

  12. Gul, G., Kurugollu, F.: SVD-based universal spatial domain image steganalysis. IEEE Trans. Inf. Forensics Secur. 5(2), 349–353 (2010). https://doi.org/10.1109/TIFS.2010.2041826

    Article  Google Scholar 

  13. Zhang, J., Zhang, D.: Detection of LSB Matching Steganography in Decompressed Images. IEEE Signal Process. Lett. 17(2), 141–144 (2010). https://doi.org/10.1109/LSP.2009.2035379

    Article  Google Scholar 

  14. Ashwaq, A., et al.: Permission vs. app limiters: profiling smartphone users to understand differing strategies for mobile privacy management . In: Barbosa, S. D. J. et al. (eds) CHI ’22: CHI Conference on Human Factors in Computing Systems, New Orleans, 29 April 2022 - 5 May 2022. ACM, 2022, 406:1- 406:18. https://doi.org/10.1145/3491102.3517652

  15. Oberheide, J., Miller, C.: Dissecting the android bouncer. In: SummerCon2012, New York 95, 110 (2012)

  16. Priyam, P., et al.: On the effectiveness of random testing for Android: or how i learned to stop worrying and love the monkey . In: Bai, X., Jenny Li, J., Ulrich, A. (eds) Proceedings of the 13th International Workshop on Automation of Software Test, AST@ICSE 2018, Gothenburg, Sweden, 2018. ACM, 2018, pp. 34-37. https://doi.org/10.1145/3194733.3194742

  17. Blake Montgomery. Oklahoma 13-year-old believed to be first person ever to beat Tetris. The Guardian. 2024. https://www.theguardian.com/technology/2024/jan/03/oklahoma-teen-beat-tetris-first-personwillis-gibson

  18. Swarup, C., et al.: Towards a systematic study of the covert channel attacks in smartphones . In: Tian, J., Jing, J., Srivatsa, M. (eds) International Conference on Security and Privacy in Communication Networks - 10th International ICST Conference, SecureComm 2014, Beijing, China, 2014, Revised Selected Papers, Part I. Vol. 152. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering. Springer, 2014, pp. 427-435 https://doi.org/10.1007/978-3-319-23829-6_29

  19. Okhravi, H., Bak, S., King, S. T.: Design, implementation and evaluation of covert channel attacks. In: IEEE International Conference on Technologies for Homeland Security (HST). IEEE. 2010, 481–487 (2010)

  20. Computer Security Resource Center (CSRC). Covert channel. National Institute of Standards and Technology (NIST). (2024). https://csrc.nist.gov/glossary/term/covert channel

  21. Anderson, R.J., Petitcolas, F.A.P.: On the limits of steganography. IEEE J. Sel. Areas Commun. 16(4), 474–481 (1998). https://doi.org/10.1109/49.668971

    Article  Google Scholar 

  22. Johnson, N.F., Jajodia, S.: Exploring Steganography: seeing the Unseen. Computer 31(2), 26–34 (1998). https://doi.org/10.1109/MC.1998.4655281

    Article  Google Scholar 

  23. Serdar, C., Brodley, C. E., Clay, S.: IP covert timing channels: design and detection. In: Atluri, V., Pfitzmann, B., McDaniel, P. D. (eds) Proceedings of the 11th ACM Conference on Computer and Communications Security, CCS 2004, Washington, 2004. ACM, 2004, pp. 178–187. https://doi.org/10.1145/1030083.1030108

  24. Yuanzhang, L., et al.: A robust packet-dropping covert channel for mobile intelligent terminals. Int. J. Intell. Syst. 37(10), 6928–6950 (2022). https://doi.org/10.1002/INT.22868

    Article  Google Scholar 

  25. Han, J., et al.: Covert timing channel detection method based on time interval and payload length analysis. Comput. Secur. 97, 101952 (2020). https://doi.org/10.1016/J.COSE.2020.101952

    Article  Google Scholar 

  26. Kevin, L., Jana, D.: Covert channels in network time security. In: Manjunath, B. S. et al. (eds) IH &MMSec ’22: ACM Workshop on Information Hiding and Multimedia Security, Santa Barbara, 2022. ACM, 2022, pp. 69–79. https://doi.org/10.1145/3531536.3532947

  27. Jie, L., et al.: A timestamp-based covert data transmission method in industrial control system. In: 7th IEEE International Conference on Data Science in Cyberspace, DSC 2022, Guilin, China, 2022. IEEE, 2022, pp. 526–532. https://doi.org/10.1109/DSC55868.2022.00079

  28. Yunjing, X., et al.: An exploration of L2 cache covert channels in virtualized environments . In: Cachin, C., Ristenpart, T. (eds) Proceedings of the 3rd ACM Cloud Computing Security Workshop, CCSW 2011, Chicago, 2011. ACM, 2011, pp. 29–40. https://doi.org/10.1145/2046660.2046670

  29. Clémentine, M., et al.: C5: Cross-cores cache covert channel. In: Almgren, M., Gulisano, V., Maggi, F. (eds) Detection of Intrusions and Malware, and Vulnerability Assessment - 12th International Conference, DIMVA 2015, Milan, Italy, Proceedings, Vol. 9148. Lecture Notes in Computer Science. Springer, 2015, pp. 46–64. https://doi.org/10.1007/978-3-319-20550-2_3https://doi.org/10.1007/978-3-319-20550-2%5C_3

  30. Stergiopoulos, G., et al.: Dropping malware through sound injection: a comparative analysis on Android operating systems. Comput. Secur. 105, 102228 (2021). https://doi.org/10.1016/J.COSE.2021.102228

    Article  Google Scholar 

  31. Guri, M., Solewicz, Y.A., Elovici, Y.: Fansmitter: acoustic data exfiltration from air-Gapped computers via fans noise. Comput. Secur. 91, 101721 (2020). https://doi.org/10.1016/J.COSE.2020.101721

    Article  Google Scholar 

  32. Guri, M.: Optical air-gap exfiltration attack via invisible images. J. Inf. Secur. Appl. 46, 222–230 (2019). https://doi.org/10.1016/J.JISA.2019.02.004

    Article  Google Scholar 

  33. Mordechai, G.: Optical covert channel from air-gapped networks via remote orchestration of router/switch LEDs . In: Brynielsson, J. (ed) European Intelligence and Security Informatics Conference, EISIC 2018, Karlskrona, Sweden, 2018. IEEE, 2018, pp. 54–60. https://doi.org/10.1109/EISIC.2018.00016

  34. Guri, M.: Exfiltrating data from airgapped computers via ViBrAtIoNs. Future Gener. Comput. Syst. 122, 69–81 (2021). https://doi.org/10.1016/J.FUTURE.2021.03.025

    Article  Google Scholar 

  35. Guri, M., Zadov, B., Elovici, Y.: ODINI: escaping sensitive data from Faraday- caged, air-gapped computers via magnetic fields. IEEE Trans. Inf. Forensics Secur. 15, 1190–1203 (2020). https://doi.org/10.1109/TIFS.2019.2938404

    Article  Google Scholar 

  36. Mordechai, G., Andrey, D., Yuval, E.: MAGNETO: covert channel between air-gapped systems and nearby smartphones via CPU-generated magnetic fields. In: CoRR abs/1802.02317 (2018). arXiv: 1802.02317

  37. Mordechai, G., et al.: BitWhisper: covert signaling channel between air-gapped computers using thermal manipulations . In: CoRR abs/1503.07919 (2015). arXiv: 1503.07919

  38. Mordechai, G.: HOTSPOT: crossing the air- gap between isolated PCs and nearby smartphones using temperature. In: European Intelligence and Security Informatics Conference, EISIC 2019, Oulu, Finland, November 26-27, 2019. IEEE (2019), pp. 94–100. https://doi.org/10.1109/EISIC49498.2019.9108874

  39. Guri, M.: AIR-FI: leaking data from air-gapped computers using Wi-Fi frequencies. IEEE Trans. Depend. Secur. Comput. 20(3), 2547–2564 (2023). https://doi.org/10.1109/TDSC.2022.3186627

    Article  Google Scholar 

  40. Mordechai, G.: RAMBO: Leaking secrets from air-gap computers by spelling covert radio signals from Computer RAM. In: Fritsch, L., Hassan, I., Paintsil, E. (eds) Secure IT Systems - 28th Nordic Conference, NordSec 2023, Oslo, Norway, 2023, Proceedings. Vol. 14324. Lecture Notes in Computer Science. Springer, 2023, pp. 144–161. https://doi.org/10.1007/978-3-031-47748-5_9

  41. César, J., Castro, H., et al.: Steganography in games: a general methodology and its application to the game of Go. Comput. Secur. 25(1), 64–71 (2006). https://doi.org/10.1016/J.COSE.2005.12.001

    Article  Google Scholar 

  42. Farn, E.-J., Chen, C.-C.: Novel steganographic method based on jig swap puzzle images. J. Electron. Imaging 18(1), 013003 (2009). https://doi.org/10.1117/1.3073979

    Article  Google Scholar 

  43. Farn, E.-J., Chen, C.-C.: Jigsaw puzzle images for steganography. Opt. Eng. 48(7), 077006 (2009)

    Article  Google Scholar 

  44. Zhan-He, O., Chen, L.-H.: A steganographic method based on tetris games. Inf. Sci. 276, 343–353 (2014). https://doi.org/10.1016/J.INS.2013.12.024

  45. Desoky, A., Younis, M.F.: Chestega: chess steganography methodology. Secur. Commun. Netw. 2(6), 555–566 (2009). https://doi.org/10.1002/SEC.99

    Article  Google Scholar 

  46. Lee, H.-L., Lee, C.-F., Chen, L.-H.: A perfect maze based steganographic method. J. Syst. Softw. 83(12), 2528–2535 (2010). https://doi.org/10.1016/J.JSS.2010.07.054

    Article  Google Scholar 

  47. Philip C., Ritchey., Vernon, R.: Covert channels in combinatorial games. In: Riley, G. F., Quaglia, F., Himmelspach, J. (eds) International ICST Conference on Simulation Tools and Techniques, SIMUTOOLS ’12, Sirmione- Desenzano, Italy, 2012. ICST/ACM, 2012, pp. 234–241. https://doi.org/10.4108/ICST.SIMUTOOLS.2012.247733

  48. Mahato, S., Kumar Yadav, D., Ali Khan, D.: A minesweeper game-based steganography scheme. J. Inf. Secur. Appl. 32, 1–14 (2017). https://doi.org/10.1016/J.JISA.2016.11.005

    Article  Google Scholar 

  49. Susmita, M.: Snake-Stega: A snake gamebased steganography scheme. In: 2023 Third International Conference on Secure Cyber Computing and Communication (ICSCCC). IEEE (2023), pp. 167-171

  50. ŞATIR, E., Güner, K.: A snake game steganography method based on S-boxes. Düzce Üniversitesi Bilim ve Teknoloji Dergisi 5(1), 193–209 (2017)

  51. Qi, W., et al.: Construction and mitigation of user-behavior-based covert channels on smartphones. IEEE Trans. Mob. Comput. 17(1), 44–57 (2018). https://doi.org/10.1109/TMC.2017.2696945

    Article  Google Scholar 

  52. Efthimios, A., Constantinos, P.: Hey doc, is this normal?: exploring android permissions in the post marshmallow era. In: Ali, S. S., Danger, J. L., Eisenbarth, T. (eds) Security, Privacy, and Applied Cryptography Engineering - 7th International Conference, SPACE 2017, Proceedings. Vol. 10662. Lecture Notes in Computer Science. Springer, 2017, pp. 53–73. https://doi.org/10.1007/978-3-319-71501-8_4

  53. Adrienne, P. F., et al.: Android permissions: user attention, comprehension, and behavior. In: Cranor L. F. (ed) Symposium On Usable Privacy and Security, SOUPS ’12, Washington, 2012. ACM, 2012, p. 3.https://doi.org/10.1145/2335356.2335360

  54. Alexios, M., et al.: A Qualitative metrics vector for the awareness of smartphone security users . In: Furnell, S., Lambrinoudakis, C., López, J. (eds) Trust, Privacy, and Security in Digital Business - 10th International Conference, TrustBus 2013, Prague, Czech Republic, 2013. Proceedings. Vol. 8058. Lecture Notes in Computer Science. Springer, 2013, pp. 173–184. https://doi.org/10.1007/978-3-642-40343-9_15

  55. Mylonas, A., Kastania, A., Gritzalis, D.: Delegate the smartphone user? Security awareness in smartphone platforms. Comput. Secur. 34, 47–66 (2013). https://doi.org/10.1016/J.COSE.2012.11.004

    Article  Google Scholar 

  56. Michael. How to hack android mobile device remotely using metasploit framework. https://shell-terminal.medium.com/how-to-hackandroid-mobile-device-remotely-using-metasploit-framework-db7ba2f6a27b

  57. Will, G., John, P.: Cybercrime and espionage: an analysis of subversive multi-vector threats. Newnes (2011)

  58. Ryan., F., Xinyuan, W.: CodeXt: automatic extraction of obfuscated attack code from memory dump. In: Chow, S. S. M. et al. (eds) Information Security - 17th International Conference, ISC 2014, Hong Kong, China, 2014. Proceedings. Vol. 8783. Lecture Notes in Computer Science. Springer, 2014, pp. 502–514. https://doi.org/10.1007/978-3-319-132570_32

  59. Rapid 7. Polymorphic XOR Additive Feedback Encoder. https://www.rapid7.com/db/modules/encoder/x86/shikata_ga_nai/

  60. Donald, E. K.: The art of computer programming, sorting and searching, Volume III, 2nd Edition. Addison-Wesley (1998). isbn: 0201896850. https://www.worldcat.org/oclc/312994415

  61. Thomas., H., Cormen, et al.: Introduction to Algorithms. MIT Press (2022)

  62. Peter, D.: Rfc1951: Deflate compressed data format specification version 1.3. Tech. rep. (1996)

  63. Peter, D.: GZIP file format specification version 4.3. Tech. rep. (1996)

  64. Tetris, W.: TGM randomizer. Tetris Fandom. https://tetris.fandom.com/wiki/TGM_randomizer%7D

  65. Nick, T., et al.: A taxonomy of side channel attacks on critical infrastructures and relevant systems . In: Critical Infrastructure Security and Resilience: Theories, Methods, Tools and Technologies (2019), pp. 283–313

  66. Gritzalis, D., et al.: Exiting the risk assessment maze: a meta-survey. ACM Comput. Surv. 51(1), 11:1-11:30 (2018).https://doi.org/10.1145/3145905

  67. Bhandari, S., et al.: SWORD: semantic aWare andrOid malwaRe detector. J. Inf. Secur. Appl. 42, 46–56 (2018). https://doi.org/10.1016/J.JISA.2018.07.003

    Article  Google Scholar 

  68. Surendran, R., Thomas, T., Emmanuel, S.: GSDroid: graph signal based compact feature representation for android malware detection. Expert Syst. Appl. 159, 113581 (2020). https://doi.org/10.1016/J.ESWA.2020.113581

    Article  Google Scholar 

  69. Jan, S., et al.: Integrity verification and behavioral classification of a large dataset applications pertaining smart OS via blockchain and generative models. Expert Syst. J. Knowl. Eng. 38, 4 (2021). https://doi.org/10.1111/EXSY.12611

    Article  Google Scholar 

  70. Papadopoulos, H., et al.: Android malware detection with unbiased confidence guarantees. Neurocomputing 280, 3–12 (2018). https://doi.org/10.1016/J.NEUCOM.2017.08.072

    Article  Google Scholar 

  71. Feng, P., et al.: A novel dynamic android malware detection system with ensemble learning. IEEE Access 6, 30996–31011 (2018). https://doi.org/10.1109/ACCESS.2018.2844349

    Article  Google Scholar 

  72. Jerbi, M., et al.: On the use of artificial malicious patterns for android malware detection. Comput. Secur. 92, 101743 (2020). https://doi.org/10.1016/J.COSE.2020.101743

    Article  Google Scholar 

  73. Puerta, J.G., et al.: Detecting malicious Android applications based on the network packets generated. Neurocomputing 456, 629–636 (2021). https://doi.org/10.1016/J.NEUCOM.2020.08.095

    Article  Google Scholar 

  74. D’Angelo, G., Ficco, M., Palmieri, F.: Malware detection in mobile environments based on Autoencoders and API-images. J. Parallel Distrib. Comput. 137, 26–33 (2020). https://doi.org/10.1016/J.JPDC.2019.11.001

    Article  Google Scholar 

  75. Abada. A., et al.: Android Malware detection based on system calls analysis and CNN classification. In: 2019 IEEE Wireless Communications and Networking Conference Workshop, WCNC Workshops 2019, Marrakech, Morocco, April 15–18, 2019. IEEE, 2019, pp. 1–6. https://doi.org/10.1109/WCNCW.2019.8902627. url: https://doi.org/10.1109/WCNCW.2019.8902627

  76. James, T., Thomas, B., David, B.: Practical lossless compression with latent variables using bits back coding. In: 7th International Conference on Learning Representations, ICLR 2019, New Orleans (2019). OpenReview.net, 2019. https://openreview.net/forum?id=ryE98iR5tm

  77. James, T., Thomas, B., David, B.: Practical lossless compression with latent variables using bits back coding . In: 7th International Conference on Learning Representations, ICLR 2019, New Orleans (2019). OpenReview.net (2019). https://openreview.net/forum?id=ryE98iR5tm

  78. Jarek, D.: Asymmetric numeral systems. In: CoRR abs/0902.0271 (2009). arXiv: 0902.0271

  79. Kaspersky.: Kaspersky discloses iPhone hardware feature vital in Operation Triangulation case. Kaspersky. https://www.kaspersky.com/about/press-releases/2023_kasperskydiscloses- iphone-hardware-feature-vitalin- operation-triangulation-case%7D

  80. Zack, W.: Russian malware controls hiding in plain sight -on Britney Spears’ Instagram page. ZDNET. https://www.zdnet.com/article/russian-malware-controls-hiding-in-plain-sight-on-britney-spears-instagram-account/%7D

  81. Catalin, C.: Russian state hackers use britney spears instagram posts to control Malware. BleepingComputer. https://www.bleepingcomputer.com/news/security/russian-state-hackers-use-britney-spears-instagram-posts-to-control-malware/%7D

  82. Android. Cloud-based protections. Google. url: https://developers.google.com/android/play-protect/cloud-based-protections%7D

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Dimitris Gritzalis.

Ethics declarations

Conflict of interest

None of the authors have received a speaker honorarium from any company. All authors declare that none of them has any Conflict of interest.

Ethical approval

This article does not contain any studies with animals performed by any of the authors.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Vasilellis, E., Botsos, V., Anagnostopoulou, A. et al. Gaming the system: tetromino-based covert channel and its impact on mobile security. Int. J. Inf. Secur. 23, 3007–3027 (2024). https://doi.org/10.1007/s10207-024-00875-3

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10207-024-00875-3

Keywords

Navigation