DVa: Extracting Victims and Abuse Vectors from Android Accessibility Malware

DVa: Extracting Victims and Abuse Vectors from Android Accessibility Malware

Speakers: Haichuan Xu, PhD Candidate, Georgia Tech; Mohamed Moustafa Dawoud; Jeman Park; Brendan Saltaformaggio, Professor, Georgia Tech

Conference: USENIX Security '24

YouTube: https://www.youtube.com/watch?v=-GZ8WGhrivM

Overview

This talk introduces DVa (Detector of Victim-specific Accessibility Abuse), a novel system designed to comprehensively analyze and mitigate Android accessibility malware. Presented by Haichuan Xu (Ken) from Georgia Tech, DVa addresses critical shortcomings in current Android malware detection by providing actionable intelligence on targeted victim applications, specific abuse vectors, and adopted persistence mechanisms. The research highlights the "double-edged sword" nature of Android's Accessibility Service, a powerful utility intended for user assistance but frequently co-opted by attackers for malicious purposes, such as eavesdropping on screens and automating GUI interactions.

The significance of DVa lies in its ability to provide granular, context-rich information that goes beyond mere detection. For Google Play Protect, DVa offers a backend solution to inform users about compromised assets, alert app developers to specific attack methods, and empower Android OS developers to block future illicit actions. By simulating victim app interactions and employing symbolic analysis, DVa overcomes the challenges posed by sophisticated malware techniques like encoded victim searches, dynamic code loading, and trigger-based execution, thereby fortifying the Android ecosystem against increasingly advanced threats.

The talk underscores the critical need for a system like DVa, as accessibility malware continues to pose a significant threat to user privacy and financial security. The detailed analysis provided by DVa enables a more proactive and targeted defense strategy, moving beyond generic malware alerts to provide precise insights that can lead to more effective user protection and platform hardening.

Background

▶ Watch: Introduction to Android Accessibility Service abuse (0:00)

Android's Accessibility Service (often referred to as the Ali Service) is a core component designed to enhance the usability of the operating system for individuals with disabilities. It achieves this by providing alternative input and output methods, such as text-to-speech, voice control, and gesture recognition, allowing applications to read screen content and control GUI elements. Crucially, the Ali Service operates as an exception to Android's otherwise robust app-isolated sandbox design, granting apps the powerful capability to interact with and control the graphical user interfaces (GUIs) of other applications.

This powerful capability, while benign in its intended use, has become a prime target for attackers. Common abuse techniques leverage the Ali Service to eavesdrop on user screens (e.g., to steal credentials) and conduct automated GUI actions without user consent (e.g., initiating transactions, changing settings). Accessibility malware typically targets specific applications, performs victim app manipulations, and employs Ali-based persistence mechanisms to make itself difficult to remove.

A compelling real-world example demonstrated in the talk is the PixDealer accessibility malware. This malware impersonates a cashback app for a Brazilian banking application called Pack Bank. When a user opens the malware, it displays a phishing screen prompting them to grant accessibility permission. Once granted, the malware sends a notification to "open Pack Bank for synchronization." Upon the user opening the legitimate banking app, PixDealer automatically clicks the "show balance" button to ascertain the user's funds. Subsequently, it overlays a fake screen while, underneath, it programmatically clicks "initiate transaction," enters an attacker's account number, inputs the available balance, and clicks "send money," transferring all funds to the attacker.

Current Android malware mitigation efforts, primarily led by Google Play Protect, face significant challenges in comprehensively addressing accessibility malware. Ideal mitigation would require identifying victim targets, abuse vectors, and persistence mechanisms. However, malware often employs techniques such as encoded victim app searches (e.g., one-way hash functions that make decoding impossible without the correct victim environment), dynamic code loading (where abuse code isn't present at the start of analysis), and trigger-based execution (leading to incomplete extraction of persistence mechanisms). These sophisticated tactics render traditional static and dynamic analysis insufficient for providing the detailed intelligence needed for effective defense.

Key Findings

▶ Watch: Challenges in mitigating accessibility malware effectively (2:55)

The core insight underpinning DVa's design is that accessibility abuse, despite its sophistication, is a "double-edged sword." The very mechanisms malware uses for attack also provide unique opportunities for detection and analysis. Specifically, DVa leverages three key observations about accessibility malware behavior:

1. Victim App Monitoring: Malware must first monitor victim applications before loading and executing specific abuse code. This necessity allows DVa to simulate victim app actions and reveal targeted applications.
2. GUI State Querying: Malware queries the victim app's GUI state before conducting tailored abuse actions. DVa capitalizes on this by broadcasting accessibility events and monitoring malware responses.
3. Device Control Disruption: Malware attempts to disrupt device control via the GUI for persistence. DVa applies triggers to device control screens to intercept and infer persistence mechanisms.

Through a large-scale evaluation involving 9,850 accessibility malware samples spanning 197 malware families and a database of 37,000 real victim apps, DVa achieved an average runtime of 110 seconds with no frontend overhead. The evaluation yielded several critical findings:

• Prevalent Abuse Vectors: The most common abuse vectors across all categories of victim apps were stealing credentials and conducting automatic transactions.
• Targeted App Categories: A significant majority of accessibility malware targets financial applications: 83% targeted banking apps and 70% targeted authentication apps. Overall, 74% of identified victims were banking applications, with 7% being cryptocurrency applications.
• Widespread Persistence: DVa extracted seven categories of accessibility-enabled persistence mechanisms. Alarmingly, 92% of malware samples prevented users from uninstalling the malware or revoking its accessibility permission.
• Intrusive but Less Common Behaviors: While less frequently observed, more intrusive behaviors included 19% of malware preventing users from powering off or restarting their device, and 2% escalating to admin privileges using accessibility features.

These findings highlight the severe threat posed by accessibility malware, particularly to financial and authentication applications, and underscore the critical need for robust detection and mitigation strategies like DVa.

Technical Deep Dive

▶ Watch: DVa's core insight and three-component solution overview (4:00)

DVa is designed as a cloud-based solution that integrates with existing security infrastructure, such as Google Play Protect. When an accessibility malware sample is detected, it is sent to DVa's backend along with a set of device applications for comprehensive analysis. DVa's architecture comprises three core components, each addressing a specific challenge in malware analysis: the victim guided sandbox, the abuse vector guided symbolic analysis, and the accessibility trigger and interception sandbox.

The first key component is the victim guided sandbox. This sandbox leverages two primary insights into malware behavior. The first insight is that accessibility malware monitors victim applications before loading and executing any specific abuse code. To exploit this, DVa employs dynamic hooks on victim query APIs, such as getInstalledApplications, to return real victim app parameters to the malware. These parameters are sourced from a comprehensive victim parameter database containing 37,000 real victim app static parameters, including package names and launch intents. DVa then monitors the malware's code loading by hooking class loaders. If the malware loads code after verifying the presence of specific victims, DVa identifies those applications as targets. For instance, in the PixDealer example, DVa would identify Pack Bank as a target because the malware scans for it and loads Pack Bank-specific abuse code.

The second insight for the victim guided sandbox is that accessibility malware queries the victim app's GUI state before conducting tailored abuse actions. DVa actively broadcasts victim accessibility events, specifically WindowStateChange events, to mimic the initiation of victim apps. It then monitors the malware's GUI action responses to these events. If the malware performs GUI actions after observing these accessibility events, DVa confirms the victim app. For PixDealer, DVa would confirm Pack Bank as a target because the malware uses accessibility to click the "show balance" button immediately after Pack Bank starts.

The second core component is the abuse vector guided symbolic analysis. This module focuses on identifying the specific malicious actions performed by the malware. DVa first collects and models common API sequences and data flows associated with real-world malware abuse vectors. Examples include "automatic transaction" (where malware injects clicks or text input) and "stealing credentials" (where malware logs screens or eavesdrops on text inputs). To confirm these API sequences and data flows, DVa employs symbolic analysis, recording the execution constraints of each program path. By solving these execution constraints, DVa can attribute specific abuse vectors to the identified victim applications. The output is a victim-specific abuse vector report, detailing precisely how each victim app is targeted. For example, DVa would report that PixDealer targets Pack Bank by conducting automated transactions and stealing user credentials.

The final component is the accessibility trigger and interception sandbox, designed to uncover malware persistence mechanisms. DVa models the triggers and behaviors of known accessibility persistence mechanisms. Examples include "disabling device protections" (e.g., turning off Google Play Protect in device settings) and "preventing information lookup or uninstallation" (e.g., using accessibility to navigate away from the app's information screen or return home when a user tries to uninstall). DVa applies these triggers by sending intents to navigate to the persistence mechanism's trigger screens. It then captures the malware's accessibility behaviors by intercepting its accessibility actions, such as pressing the "back" button or returning to the home screen. If both the trigger and the expected accessibility behaviors are observed, DVa identifies the persistence mechanism. In the PixDealer case, DVa would determine that the malware persists by preventing users from revoking its granted accessibility permission.

Demo / Proof of Concept

▶ Watch: DVa's Symbolic Analysis for abuse vector detection (6:45)

While the talk did not feature a live, interactive demo of DVa itself, the presentation effectively used the PixDealer malware example as a proof of concept to illustrate both the problem DVa solves and how DVa would analyze such an attack. This real-world scenario served as a compelling demonstration of the sophisticated nature of accessibility malware and the granular insights DVa provides.

The PixDealer malware, impersonating a cashback app for Pack Bank, was shown in action. The sequence of events included:

1. The malware displaying a phishing screen to trick the user into granting accessibility permission.
2. Upon permission grant, a notification prompting the user to open the legitimate Pack Bank app.
3. Once Pack Bank is open, the malware using accessibility to automatically click the "show balance" button, demonstrating GUI state querying and automated GUI actions.
4. An overlay screen hiding the malicious activity while the malware programmatically clicks "initiate transaction," enters attacker details, and transfers funds, showcasing the automated transaction abuse vector.
5. The implicit demonstration of persistence through the malware's ability to maintain control and perform actions without user intervention, and its likely attempts to prevent uninstallation or permission revocation.

DVa's analysis of this scenario would proceed as follows:

• Victim Guided Sandbox: DVa would identify Pack Bank as a victim because PixDealer scans for its presence and loads Pack Bank-specific abuse code. It would also observe PixDealer's automated interaction with Pack Bank's GUI after detecting WindowStateChange events, confirming Pack Bank as a target.
• Abuse Vector Guided Symbolic Analysis: DVa would attribute the "automated transaction" abuse vector to PixDealer targeting Pack Bank, based on the API sequences for injecting clicks and text input to initiate the money transfer. It would also identify "stealing credentials" by observing the malware's ability to read screen contents, such as the user's account balance.
• Accessibility Trigger and Interception Sandbox: DVa would detect that PixDealer persists by preventing users from revoking its granted accessibility permission. This would be inferred by applying triggers (e.g., navigating to the app info screen) and observing the malware's intercepting behaviors (e.g., automatically navigating away).

This illustrative walkthrough effectively showcased DVa's capability to dissect complex accessibility malware attacks into their fundamental components: targeted victims, specific abuse methods, and persistence strategies, providing the detailed intelligence needed for effective mitigation.

Defensive Implications

▶ Watch: DVa's Sandbox for persistence mechanism discovery (7:50)

The detailed insights provided by DVa have profound implications for strengthening defenses against Android accessibility malware across multiple fronts:

• For Users: DVa's ability to identify specific victim applications means that users can be notified precisely which of their apps (e.g., banking, authentication) have been targeted by a detected malware. This allows users to take immediate action, such as changing passwords, securing other assets linked to those applications, or contacting their bank, rather than simply uninstalling a malicious app without understanding the extent of the compromise. Education about the dangers of granting accessibility permissions to untrusted apps remains paramount.
• For App Developers: The extraction of abuse vectors by DVa provides critical intelligence for app developers. Knowing how malware interacts with their application's GUI (e.g., specific buttons clicked, input fields targeted, screens eavesdropped) enables them to deploy tailored defenses. This could involve implementing robust anti-automation mechanisms, strengthening critical GUI elements against programmatic clicks, or integrating more sophisticated detection of unusual accessibility service interactions within their apps. For instance, if malware is known to click a "transfer" button, developers could add an extra biometric verification step for that specific action.
• For Android OS Developers (Google Play Protect & Android Platform): DVa's comprehensive output on persistence mechanisms is invaluable for Android OS developers. By understanding how malware attempts to prevent uninstallation, disable protections, or maintain control, they can develop more effective platform-level mitigations. This includes blocking future illegal actions through OS updates, enhancing the detection of malicious accessibility service usage, and improving the resilience of core system settings against manipulation. The data on prevalent persistence techniques, suchs as preventing permission revocation (92% of malware), can guide the prioritization of these defensive enhancements.
• General Security Posture: The research highlights the need for continuous monitoring and adaptation. The "double-edged sword" nature of the Accessibility Service means that while it's a powerful tool, its misuse requires constant vigilance. DVa's automated, backend analysis capability allows security vendors like NetScope to fortify their defenses against mobile malware by providing a scalable solution for extracting crucial threat intelligence that was previously difficult to obtain.

By providing specific, actionable intelligence on victims, abuse vectors, and persistence, DVa moves beyond generic malware detection to enable a more intelligent, proactive, and layered defense strategy for the Android ecosystem.

Key Takeaways

• Accessibility Service is a Double-Edged Sword: While designed for user assistance, Android's powerful Accessibility Service is widely abused by malware to control GUIs, eavesdrop on screens, and automate malicious actions.
• DVa Provides Granular Threat Intelligence: DVa is a novel, cloud-based system that extracts three critical pieces of information from accessibility malware: targeted victim applications, specific abuse vectors, and persistence mechanisms, addressing limitations of traditional analysis.
• Financial Apps Are Primary Targets: A vast majority of accessibility malware (83% of samples analyzed) specifically targets banking and authentication applications, highlighting the severe financial risk to users.
• Credential Stealing and Automated Transactions Dominate: The most prevalent abuse vectors involve stealing user credentials and conducting automated financial transactions, demonstrating direct and immediate harm.
• Persistence Mechanisms Are Widespread: Nearly all accessibility malware (92%) employs persistence mechanisms, primarily preventing users from uninstalling the app or revoking its accessibility permissions, making removal difficult.
• Actionable Insights for Enhanced Defense: DVa's detailed output empowers Google Play Protect to notify users of compromised assets, enables app developers to deploy tailored defenses, and assists Android OS developers in blocking future illicit actions, leading to a more secure mobile ecosystem.

About the Speaker(s)

The primary presenter of this work was Haichuan Xu, also known as Ken, a PhD candidate at Georgia Tech. He is advised by Professor Brendan Saltaformaggio and Professor Jeman Park, both of whom are co-authors on the paper and involved in the research. Mohamed Moustafa Dawoud is also credited as a co-author and speaker. The research collaboration with NetScope, a cloud security solutions company, underscores the practical relevance and industry impact of DVa in identifying and mitigating malware threats. The team's work at Georgia Tech focuses on advancing mobile security and developing innovative solutions to protect users from sophisticated cyber threats.