Let's talk about detecting mobile Malware.
So the most important thing for you to realize--
signature-based Malware is what Bit Defender
can detect Bit Defender is what is
built into Cellebrite Physical Analyzer
to detect mobile Malware.
Cellebrite is the only tool at the time of writing this that
will scan for mobile Malware.
It is as strong as the Bit Defender signatures.
So you have to make sure you're updating them.
And I'm going to walk you through that.
What if it's not signature-based Malware?
So what if it's specification-based
or behavioral-based or cloud-based or data mining?
What you're going to have to understand
is how you're going to detect it.
So specification-based-- what you have to do
is consider, what is normal activity versus what
is that app actually doing?
For behavioral-based-- so it's going to go through,
and behavioral-based detection is
going to say, OK, what is the Malware's action?
How is it going to talk to the databases?
How does it store data?
So it's literally watching and monitoring
that Malware in action.
For data mining, the detection is
going to go through and detect large patterns of data.
For cloud-based, things like Google Bouncer or Google Play
Store for Malware-- what it's going to do
is detect activity through dynamic analysis.
Now, this is the first time you've heard the word
dynamic analysis from me.
Dynamic means in action.
It's watching it live.
You're actually watching the Malware act.
Static analysis is data at rest.
This is where you have a phone image,
you grab an APK file, you examine it.
That's similar to what we are going to do in the labs.
Dynamic analysis requires additional methods.