- Android’s security team partners with Mandiant FLARE for upgrade
- The capa open source binary analysis tool is being enhanced
- Gemini AI is being thrown in the mix, too
Google is ramping up its Android security protection with new app safety tools.
In a new blog post, Google’s Lin Chen announced the company’s Android Security and Privacy Team is partnering with Mandiant FLARE, to enhance the capa open source binary analysis tool. That way, the tool will be better at analyzing ARM ELF files, often used in Android malware.
Chen said this collaboration will help detect and highlight suspicious code behaviors in native files, enabling faster malware analysis and decision-making, with the help of Gemini AI.
Detecting malware in ELF
Describing how the new tools work, Chen shared a case study of an illegal gambling app disguised as a music app. This app, found on the Google Play Store, was secretly loading gambling websites for users in specific regions. It used different anti-analysis techniques (hiding key functions in a native ELF file, timezone detection, dynamic downloading and decryption of additional malicious code) to stay hidden in plain sight.
However, by leveraging static analysis and capa, Google’s team identified these deceptive behaviors and successfully removed the app.
Capa detects malware capabilities in ELF files, and new rules have been developed specifically for Android, Chen further explained.
These rules identify behaviors like ptrace API calls (anti-debugging), extracting device and timezone info via JNI, downloading and decrypting code, using Base64 & Cipher API for encoding/encryption, allowing analysts to quickly locate suspicious functions, without needing to sift through mountains of obfuscated code.
Google also added Gemini AI to summarize the most suspicious functions highlighted by capa. The AI tool can do risk level assessments, insights into obfuscation, anti-debugging, and cloaking tactics, enabling a faster, and more effective, malware detection and rule-writing.
“Equipped with the fast-evolving Gemini, our analysts are able to spend less time on those sophisticated samples, minimising the exposure for malicious apps and ensuring the safety of Android ecosystems,” Chen concluded.
