3 ms·

Clearly, a remote controlled interpreter should not pass the Google Play verification, but I understand how detecting it can be a hard problem.

atr2 8y ago
I'm sure LOTS of applications have remote controlled interpreters.
KMag 8y ago
Well, enumerating all program states is a superset of the halting problem. False positives, false negatives, and sometimes taking an infinite amount of time to get an answer: choose at least one. (Technically only true if the phone had an infinite amount of memory, but gigabytes of memory are enough to craft an input that would take well beyond the heat death of the universe to get an answer.) In other words, even if you had some algorithm could somehow look at a program state and with 100% accuracy determine if that state was the start of an interpreter main loop, there would be at least one program where you couldn't be certain that you'd run your algorithm on every program state.
- cornholio 8y ago
  I stopped myself from typing "Halting problem" because essentially, antivirus software should not exist for the same reasons. Yet antiviruses clearly work - it's the entire premise of the article that Android is more vulnerable to droppers than classic computers running antiviruses. So the same techniques used by antiviruses, be it heuristics, signatures of known interpreters and droppers, simulated execution could be used by app stores to drastically reduce bad actors. The fundamental weakness will always be there for advanced, unique malware.
  - jessaustin 8y ago
    AV itself is much less effective than many people believe. That's true in general, and this case is no exception. The conclusion of TFA: "Interestingly enough, we have also observed that most AV's also failed in detecting the dropper campaigns (sometimes for years), meaning that some awareness needs to be raised on the topic,"

atr2 8y ago

I'm sure LOTS of applications have remote controlled interpreters.

KMag 8y ago

Well, enumerating all program states is a superset of the halting problem. False positives, false negatives, and sometimes taking an infinite amount of time to get an answer: choose at least one. (Technically only true if the phone had an infinite amount of memory, but gigabytes of memory are enough to craft an input that would take well beyond the heat death of the universe to get an answer.) In other words, even if you had some algorithm could somehow look at a program state and with 100% accuracy determine if that state was the start of an interpreter main loop, there would be at least one program where you couldn't be certain that you'd run your algorithm on every program state.

cornholio 8y ago
I stopped myself from typing "Halting problem" because essentially, antivirus software should not exist for the same reasons. Yet antiviruses clearly work - it's the entire premise of the article that Android is more vulnerable to droppers than classic computers running antiviruses. So the same techniques used by antiviruses, be it heuristics, signatures of known interpreters and droppers, simulated execution could be used by app stores to drastically reduce bad actors. The fundamental weakness will always be there for advanced, unique malware.
- jessaustin 8y ago
  AV itself is much less effective than many people believe. That's true in general, and this case is no exception. The conclusion of TFA: "Interestingly enough, we have also observed that most AV's also failed in detecting the dropper campaigns (sometimes for years), meaning that some awareness needs to be raised on the topic,"