How Can Smartphones Detect Malware Efficiently?

TL;DR

Mobile malware defense must avoid constant scanning because continuous processing drains limited phone batteries. The proposed method periodically clears active processes, overwrites RAM with a pseudorandom sequence under a strict time limit, and then scans inactive processes, allowing an external verifier to detect known malware, rootkits, and zero-day attacks within seconds.

Transcript

Go ahead. Hi, my name is Marcus Jacobsson. I'm a principal scientist at Palo Alto Research Center and a co-founder of Fat Skunk. Today, I'm going to talk about mobile malware, what the problem is, and how we can address it. So first of all, we have to agree that there's more Windows viruses and Windows malware in general than there is for Mac. Ther... Read More

Key Insights

• Mobile malware becomes economically attractive when smartphones provide criminals with a sufficiently large population of targets. The presentation predicts that growing smartphone adoption, combined with 4G services and phone-based payments, will shift criminal attention toward mobile devices.
• Expected mobile threats include Bluetooth viruses, piracy-based Trojans, and social malware. Bluetooth and Wi-Fi infections may produce geographic clusters, while social malware may appear within dense groups of people who call, message, or email one another.
• Traditional antivirus uses signature-based and behavioral detection. Signature scanning compares activity with known malicious patterns, while behavioral detection watches for suspicious conduct, but both approaches depend on surveillance that remains active enough to catch malware before it hides.
• Continuous malware surveillance consumes processing power and battery capacity. The burden grows as defenders must check longer signature lists and address malware created through kits, altered by recompilers, or automatically reshaped through polymorphism.
• Periodic verification works by temporarily removing legitimate active processes and testing whether malware remains in RAM. Malware that stays active must occupy space or spend additional time moving overwritten data into slower flash storage, making its presence detectable.
• A pseudorandom sequence can fill RAM while the verifier checks both its contents and the time required to complete the operation. A correct result produced within the predetermined interval supports the claim that no unauthorized active process interfered with the inspection.
• Inactive processes can be scanned after active RAM has been validated. Malware may remain active and become detectable, accept being swapped out and face trusted inspection, or terminate itself, in which case it no longer presents an active problem.
• Network-side analysis can connect infection status with carrier observations such as approximate location, communication relationships, DNS lookups, operating systems, and applications. Shared patterns among infected devices can indicate geographic transmission, social propagation, or another common source.

Questions & Answers

Q: Why is mobile malware expected to become more common?

Mobile malware is expected to become more common because malware authors behave like rational criminal businesses and concentrate on targets that affect their profits. The presentation predicts that smartphones will outnumber Windows machines within two to three years. It also argues that 4G will enable more phone-based activities involving payments, making smartphones both numerous targets and valuable payment platforms for attackers.

Q: Why is traditional antivirus unsuitable for smartphones?

Traditional antivirus can be unsuitable for smartphones because signature-based and behavioral defenses rely on continuing surveillance. That processing consumes power, while phones have smaller batteries and fewer power resources than computers. As the number of threats and signatures increases, checking them takes more time and effort. A mobile antivirus product may appear effective when few relevant threats exist, but the approach becomes harder to sustain as malware volume grows.

Q: What mobile malware threats does the presentation predict?

The presentation predicts many Bluetooth viruses, which cannot be observed on the network backbone, along with Trojans that are initially driven largely by piracy. It also predicts social malware, meaning malicious software that reaches a person because it previously affected friends or contacts. Bluetooth and Wi-Fi threats may spread geographically, while social threats may follow communication relationships and dense groups of connected users.

Q: How does the proposed mobile malware detection method work?

The method periodically starts a trusted guard process instead of monitoring the phone continuously. Legitimate active processes leave RAM, while the guard writes a pseudorandom sequence across the available memory and checksums it within a predetermined time. Malware that remains active must occupy space or move data elsewhere, which takes time. After validating RAM, the guard inspects inactive processes and reports the result to an external verifier.

Q: How can the method detect rootkits and zero-day attacks?

The method does not depend entirely on recognizing a previously recorded malware signature. It checks whether an unauthorized process remains active in RAM while memory is overwritten and validated. Malware that stays active becomes visible, malware that permits itself to be swapped out can be scanned while inactive, and malware that terminates is no longer running. This structure provides retroactive detection for rootkits, zero-day attacks, and other malware.

Q: When should a smartphone run the verification process?

A smartphone can run the verification process at selected moments because the method consumes power only when invoked and its main operation takes a few seconds. Suggested times include while the phone charges at night, before an important transaction such as electronic voting, when logging into a bank site, or when a server has indications that the device may be infected and requests verification.

Q: How can a carrier identify suspicious infected devices?

A carrier can periodically request verification results and determine which devices provide trusted clean responses. A device that does not respond but continues sending DNS requests or initiating phone calls is clearly operating, so the network can treat it as infected. The carrier can then examine what infected devices share, using information about approximate location, communication relationships, operating systems, applications, and network activity.

Q: How can infection patterns reveal how mobile malware spreads?

Infection patterns can reveal likely propagation routes by showing what affected devices have in common beyond ordinary averages. If the only infected devices are located in the same area, the network may suspect Bluetooth or Wi-Fi transmission. If infected devices are geographically dispersed but form a dense social network of people who communicate with one another, the network may instead suspect socially propagated malware.

Summary & Key Takeaways

• Smartphones were expected to become increasingly attractive malware targets as their numbers grew and 4G enabled more payment-related activity. Predicted threats included Bluetooth viruses, piracy-based Trojans, and social malware that spreads through relationships. Organized crime, malware kits, recompilers, and polymorphism would accelerate the volume and variation of malicious software.

• Traditional antivirus depends on continual behavioral monitoring and comparisons against known signatures. That model becomes increasingly expensive as the threat list grows, making it unsuitable for battery-constrained phones. The proposed alternative activates only when needed, removes legitimate processes from RAM, and creates a controlled environment for detecting malware that tries to remain active or hidden.

• An external verifier starts the inspection, while the phone overwrites RAM with a pseudorandom sequence and checksums the result within a predetermined time. The network can combine infection results with location, communication patterns, DNS requests, operating systems, and applications to infer whether malware spreads geographically, socially, or through another shared characteristic.