Adversaries may modify applications installed on a device to establish persistent access to a victim. These malicious modifications can be used to make legitimate applications carry out adversary tasks when these applications are in use.
There are multiple ways an adversary can inject malicious code into applications. One method is by taking advantages of device vulnerabilities, the most well-known being Janus, an Android vulnerability that allows adversaries to add extra bytes to APK (application) and DEX (executable) files without affecting the file's signature. By being able to add arbitrary bytes to valid applications, attackers can seamlessly inject code into genuine executables without the user's knowledge.[1]
Adversaries may also rebuild applications to include malicious modifications. This can be achieved by decompiling the genuine application, merging it with the malicious code, and recompiling it.[2]
Adversaries may also take action to conceal modifications to application executables and bypass user consent. These actions include altering modifications to appear as an update or exploiting vulnerabilities that allow activities of the malicious application to run inside a system application.[2]
| ID | Name | Description |
|---|---|---|
| S0440 | Agent Smith |
Agent Smith can inject fraudulent ad modules into existing applications on a device.[2] |
| S1079 | BOULDSPY |
BOULDSPY can inject malicious packages into applications already existing on an infected device.[3] |
| S0311 | YiSpecter |
YiSpecter has replaced device apps with ones it has downloaded.[4] |
| ID | Mitigation | Description |
|---|---|---|
| M1001 | Security Updates |
Security updates frequently contain patches to vulnerabilities. |
| M1006 | Use Recent OS Version |
Many vulnerabilities related to injecting code into existing applications have been patched in previous Android releases. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0649 | Detection of Compromise Application Executable | AN1730 |
For Android, detect Compromise Application Executable from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: APK, DEX, or native library written to app installation path outside MDM-authorized update mechanism — binary replacement is the persistence artifact]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |