282 Chapter8·AnalyzingMobileMalware Notes from the Underground... Using the Techniques as Rootkit MobileSandbox uses the presented techniques for dynamically analyzing a malware sample. It is only natural that the sandbox wants to hide its presence and simulate a normal system for the analyzed malware. But the same techniques can be applied to develop a malware that hides itself from the system: a rootkit. This is a perfect exam- ple of dual-use technology; it can be used for peaceful purposes or for malevolent ones. Porting to Other Mobile Operating Systems It is an interesting question as to whether presented techniques for Windows Mobile can be used for other mobile operating systems as well. Unfortunately, the answer to this is "generally, no." The system architectures are very different from Windows Mobile. Our approach is based on the fact that it is very easy for untrusted software to run as a kernel-mode process. Other operating systems are more restricted, so the support of the operating system manufacturer would be required to get a sufficient trust level for the sandbox program. Examples of the more restricted operating systems are Symbian OS and the iPhone operating system. Symbian OS, especially, implements very restricted access to almost anything, beginning with system version 9. If software wants to access system directories or manipulate other processes, it needs special Symbian OS capabilities that are not easy to obtain. The upcoming Linux phones promise to be more accessible because of the open-source nature of their operating system. Examples are the Open Handset Alliance (Android), the LiMo foundation, and Openmoko. But the future still must determine which of these platforms will really be used and gain wide acceptance. Notes on Interception Completeness There are two aspects when considering completeness: interception of every system call and recognition of the system call's signature (parameters). The solution for both aspects is described in the following. Interception The most important part is to see every system call. This is achieved through the technique depicted in Figure 8.3. We change the central pointer for the data structures to point to our