#HITBLockdown002 D1T1 - Zen: A Complex Campaign of Harmful Android Apps - Łukasz Siewierski

### Overview In this talk, Łukasz Siewierski examines 'Zen', a complex multi-family campaign of harmful Android applications attributed to a single author or development group. Rather than analyzing an isolated malware family, the presentation explores the author's evolving portfolio over time. The campaign ranges from repackaged apps with custom ad SDKs to complex rooting trojans that automate Google account creation, click fraud, and system persistence.

### Key Topics - **Custom Ad SDK Proxy**: Repackaged popular apps and fake mimic apps that route ad requests through a command-and-control (C&C) server, hiding the underlying ad networks and masking fraudulent activities from reverse engineers. - **Large-Scale Click Fraud**: Automating ad clicks via JavaScript, Android APIs, or JavaScript interfaces. The malware parsed an unusually large 287 KB JSON list sent from the C&C server containing HTML keywords and corresponding JavaScript execution snippets. - **Rooting and Fake Account Creation**: Downloading device-tailored exploits ('solutions') to gain root access. Once root is achieved, the malware silently enables Android accessibility services to automate the Google account creation wizard, using phone numbers and OTPs fetched dynamically from the C&C. - **Code Injection and System Hooking**: Using `ptrace` and memory manipulation via `/proc/<pid>/maps` to inject code (`inject.so`) into remote processes. This mechanism extracts base64-encoded CAPTCHA images for remote solving and hooks system services using Xposed to suppress reboot requests and keypress events. - **Persistence Mechanisms and Evolution**: Exploring four persistence tactics—modifying `/system/bin/install-recovery.sh`, copying binaries into `/system/priv-app`, swapping `framework.jar`, and injecting into `system_server`.

### Technical Details - **Ad Proxying**: The custom SDK requests ads directly from the C&C server, which downloads resources from legitimate ad networks and proxies them back to the client, preventing analysts from identifying which ad networks are being abused. - **Exploitation & Accessibility Abuse**: The client submits device hardware specifications to the C&C to retrieve a matching root exploit file. After gaining root privileges, it bypasses user prompts by programmatically updating `enabled_accessibility_services` and toggling `accessibility_enabled` to 1 in system settings. It then reads UI elements in the account wizard (such as 'enter the code' or base64-encoded titles). - **Process Injection & Hooking**: The injector inspects `/proc/<pid>/maps` to calculate `libc` offsets for `mmap`, `dlopen`, and `dlsym`. It injects shellcode to run arbitrary methods within target applications, including intercepting `PowerManagerService.reboot()` to return 0 and intercepting key events (power menu, volume keys). - **Obfuscation**: Certain samples embed encrypted payloads in the `assets/x/` directory using DES encryption, where the filename string serves directly as the DES key. - **Mitigations in Modern Android**: Newer Android versions significantly disrupt this toolset. Verified Boot halts boot if `/system` files or `install-recovery.sh` are tampered with, or if `framework.jar` is altered. Furthermore, restrictions on the `/proc` filesystem introduced in Android Nougat block cross-process memory inspection, breaking the injection framework.

### Takeaways The chronological evolution of Zen reveals an operational pivot: as rooting exploits became scarce, unreliable, and expensive across modern Android versions, the author shifted toward click fraud and dynamic code loading. Siewierski emphasizes that defenders must look beyond individual malware families to track the overarching goals, capabilities, and monetization pivots of malware authors.