Researchers Beat Up Google's Bouncer

Bouncer, the gatekeeper for the Android app store, looks ready for a rough adolescence. Two groups of security researchers have probed the security service for weaknesses and have had few problems bypassing it.    

Nicholas Percoco and Sean Schulte, both of security firm Trustwave, submitted increasingly malicious versions of an Android application to Google Play. Each variant of the application was scanned by Bouncer, Google's security-checking application, and it failed to flag them as malicious, the two security researcher plan to report at the Black Hat security conference in Las Vegas next month.

"We came up with a technique to hide the malicious activity from Bouncer," Percoco says. "We would upload some code (using the technique) and that would get past Bouncer, and then we upload some more, and we finally got to the point where we had a botnet."

Percoco and Schulte limited the attack so that no users were impacted, but they could have stolen photos, contacts, and passwords from the phone. In the end, they created a botnet capable of a denial-of-service attack, similar to the Low-Orbital Ion Cannon (LOIC) software used by hacktivists.

[Mobile malware hasn't yet grown to the problematic levels that once plagued Windows PCs back in the days before Trustworthy Computing, but that doesn't mean mobile vulnerabilities aren't exploitable. See 6 Discoveries That Prove Mobile Malware's Mettle.]

The researchers are not the first to show Bouncer's problems. At SummerCon earlier this month, two researchers reported on their successful attempts to used Google Play submissions to probe the capabilities of Bouncer. The researchers -- Charlie Miller of security consultancy Accuvant and Jon Oberheide, chief technology officer of mobile security firm Duo Security -- found that Bouncer only runs a submitted application for five minutes and ran applications on a virtualized phone instance running on the QEMU emulator.

Just by waiting more than five minutes to execute malicious code, cybercriminals can bypass Bouncer, says Oberheide. Another simple method, which consultant Miller used against Apple's App Store, is to submit a benign application to the app store and then modify it after acceptance.

Google is undoubtedly developing countermeasures to these techniques, but the researchers identified several ways to get by Bouncer, many of which will not easily be solved.

"There are low-hanging fruit that Google can pick off and fix, but there are others that will require a long time for solve," he says.

Google announced Bouncer earlier this year, but it had been using the security vetting service for more than a year. Over those 12 months, the number of Android users infected by malware from the Google Play store dropped by 40 percent, Google has stated. Despite its initial success weeding malware out of the Android app store, Google has a hard fight ahead to keep malicious applications out of its Google Play store, the researchers say.

While a bouncer in the physical world may let a patron into a store, if the patron start causing problems, the bouncer will eject them. In the digital world, the security service is not yet able to do that, says Percoco.

"If you start causing a problem in the bar, another bouncer is going to see you and kick you out," he says. "In the mobile app world, Google's Bouncer won't kick you out."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.