Tracking Android Malware and Auditing App Privacy for Fun and Non-Profit

Bill Budington, a technologist at the Electronic Frontier Foundation, opens by explaining that a popular Play Store app and a piece of sideloaded malware can be examined with the same toolkit. He describes how APK files are structured and where Android apps are distributed, including alternative marketplaces and their risks, and introduces apkeep, EFF's command-line tool for batch downloading apps.

The middle of the talk covers static analysis with jadx, which approximates the original Java, and apktool, which produces smali that can be modified and rebuilt. Frida handles runtime instrumentation, while mitmproxy and certificate bypasses expose encrypted traffic. Two case studies follow: a privacy audit of the Ring doorbell app, which sent data to several third parties, and a Tor-based trojan that posed as a banking app, abused accessibility permissions, and loaded hidden payloads. Obfuscated strings in that payload led to an onion service that revealed a clearnet command-and-control login page.

The talk closes with a field setup that places the proxy, Frida and SSH on one rooted Android device running Debian, so a remote auditor can monitor traffic outside a lab. The takeaway is that apps may behave differently when they know they are being watched or when they depend on location, so monitoring on the device itself can reveal their real behavior.