Android Rooting: An Arms Race between Evasion and Detection

<table class="table-group" id="tab1"><tr><td><table class="table"><tr><td class="thead-hr" colspan="2"><hr/></td></tr><tr class="thead"><td class="align_left">Keywords </td><td class="align_center">Use case </td></tr><tr><td class="thead-hr" colspan="2"><hr/></td></tr><tr><td class="align_left">daemonsu <br/>superuser <br/>supersu <br/>kinguser <br/>kingroot <br/>busybox</td><td class="align_center">Rooting-related binaries and daemons: these keywords are typical in rooted devices</td></tr><tr><td class="align_left" colspan="2"><hr/></td></tr><tr><td class="align_left">rootcloak <br/>xposed <br/>chainfire</td><td class="align_center">Keywords related to evasion apps: to evade rooting check at Java code, RootCloak uses Xposed framework to perform interception with API calls</td></tr><tr><td class="align_left" colspan="2"><hr/></td></tr><tr><td class="align_left">titanium <br/>greenify <br/>stericson <br/>kerneladiutor</td><td class="align_center">Keywords related to apps that require rooted device</td></tr><tr class="table-tr"><td colspan="2"><hr class="tbody-hr"/></td></tr></table></td></tr></table>

Security and Communication Networks

tab1

Table 1

Table 1: Android Rooting: An Arms Race between Evasion and Detection 