# VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics
## 2 Background
### Endpoint Detection and Response Systems (EDR)
#### 2.1.1 App-Specific Forensic Sources  
In the case of stealth attacks that hijack benign app functionality, a critical forensic source that could contribute towards detecting attack-related behavior are the logs of hijacked benign app events. These are typically found in app databases in the app data directory of Android internal storage (/data/data/<package_name>), which is inaccessible to users and forensic investigators unless the device is rooted.  
While app developers can make these logs available to users through different APIs or backup functionality, the output may still be insufficient to disclose app hijack attacks. The content of these logs is at the discretion of the app developers, whose interests may align more with the app's usability rather than logging events that could indicate an app hijack. Therefore, even after collecting this evidence, investigators cannot detect attack-related behavior to reconstruct the complete stealth attack steps.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**Artefact Source**} & \multicolumn{2}{c}{**Artefact Source**} & \multicolumn{2}{c}{**Artefact Source**} & \multicolumn{2}{c}{**Artefact Source**} & \multicolumn{2}{c}{**Artefact Source**} \\ \hline \multirow{4}{*}{**Forensic Sources**} & OS info & & & ✓ & & & * & * & ✓ \\  & Hardware info & & & ✓ & & & * & * & ✓ \\  & System settings & & & ✓ & & & ✓ & * & ✓ \\  & Battery statistic & ✓ & & ✓ & & ✓ & & * & ✓ \\ \hline \multirow{4}{*}{**Forensic Sources**} & Installed packages & & ✓ & ✓ & & ✓ & ✓ & * & ✓ \\  & Running processes & ✓ & & ✓ & & ✓ & & * & * \\ \hline \multirow{4}{*}{**Forensic Sources**} & Contacts & & ✓ & ✓ & ✓ & & * & * & ✓ \\  & Call logs & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & * & * & ✓ \\  & SMS/MMS & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & * & * & ✓ \\  & SIMs \& subscriptions & & ✓ & & & & * & ✓ \\  & Cellular info & ✓ & & ✓ & & ✓ & & * & ✓ \\ \hline \multirow{4}{*}{**Forensic Sources**} & Wi-Fi status \& hotspots & ✓ & & ✓ & ✓ & ✓ & * & ✓ \\  & Bluetooth info & & & ✓ & & ✓ & & * & ✓ \\  & NFC status & & & & & & & * & ✓ \\  & VPN profiles & & & & & & & * \\  & NIC info \& Netstat & ✓ & & ✓ & & & * & * \\ \hline \multirow{4}{*}{**Forensic Sources**} & Storage volume info & & & ✓ & ✓ & & * & ✓ \\  & Filesystem \& file stats & & ✓ & ✓ & & * & * \\  & Retrieve arbitrary file & & & ✓ & ✓ & & * & * \\ \hline \multirow{4}{*}{**Forensic Sources**} & Location & ✓ & ✓ & ✓ & & * & ✓ \\  & Microphone & & & & ✓ & & * & \\  & Sensor info \& logging & & ✓ & ✓ & & * & ✓ \\ \hline \multirow{4}{*}{**Forensic Sources**} & User accounts & & ✓ & & & * & * & ✓ \\  & Device user profiles & & & & * & * & * & * \\  & Calender & ✓ & ✓ & & & * & * & \\  & Browser history & & ✓ & & & * & * & * \\ \hline \multirow{4}{*}{**Forensic Sources**} & Screen state \& capture & ✓ & ✓ & ✓ & * & * & * & \\  & Key \& touch logging & & & * & & & \\ \cline{1-1}  & Remote logging & ✓ & ✓ & ✓ & ✓ & & ✓ \\ \hline \hline \end{tabular} \(\mathcal{J}\) refer to forensic artefacts that can be collected by the EDR tool. \(*\) refers to forensic artefacts that can be collected _only_ if the EDR tool has system privileges (add or root) on the device.  
\end{table}
Table 1: Forensic artefact source collection comparison of Android Forensic EDR tools, as shown in [27], as of 2021. Commercial tools in this study included: Oxygen Forensic Suite, MOBILedit, XRY Forensic Examiner’s Kit, UFED, and EnCase Mobile Investigator