How to Detect BlankBot Malware in Android Apps

This Knowledge Base article describes how to use Appdome’s AI/ML in your CI/CD pipeline to continuously deliver plugins that Detect BlankBot Malware in Android apps.

What is Detect BlankBot Malware?

How Does Appdome Protect Against BlankBot?

Taking all the above into consideration, you can use Appdome to protect against BlankBot using a combination of the following protection methods:

• RASP & App Shielding – Prevents BlankBot from injecting itself into installed apps and repackaging them. Also includes anti-tampering, anti-debugging, anti-emulator, and other protections against dynamic attacks at runtime.
• Code Obfuscation – Protects against decompiling and malicious reverse engineering which hackers use to read and understand source code.
• Root Detection –  Protects mobile apps from running on rooted devices, which exposes apps to tampering, data theft, and malware by giving attackers elevated access to system files and app data.
• MitM Attack Prevention  – Prevents BlankBot from intercepting or hijacking sessions to harvest or steal data.
• Keylogging Prevention – Prevents the use of malicious keyloggers which may be used to intercept two-factor authentication codes or harvest sensitive information.
• Protect Against Screen Sharing Malware – Prevents malware from abusing screen recording and screen sharing functions to benefit the malware.
• Block App Overlay Attacks – Detects and prevents fake/malicious screen overlays from displaying on top of the app screen and concealing the legitimate app screen. Mobile malware and Trojans like BlankBot use overlay attacks to trick users into revealing sensitive information or performing harmful actions inadvertently.
• Prevent Accessibility Services Malware – Prevents malicious actions taken by malware that exploit Android’s AccessibilityService, which when abused can be used to intercept sensitive inputs like passwords and 2FA codes, take screenshots, and simulate user actions such as taps and swipes.
• Prevent Remote Desktop Control – Detects 3rd party apps that attempt to remotely control the protected app, typically via social engineering or tricking the user.
• Google Play Store Signature Validation – protects against fake apps, clones, masquerading, which malware often do to trick users into performing harmful actions.

Each of the protections above is linked to the relevant knowledge base article for that feature, which provides detailed information about each feature and explains how to implement the protection in your Android app.

Prerequisites for Using Appdome's Detect BlankBot Malware Plugins:

To use Appdome’s mobile app security build system to Detect BlankBot Malware , you’ll need:

• Appdome account (create a free Appdome account here)

• A license for Detect Banking Trojans 

• Mobile App (.apk or .aab for Android)

• Signing Credentials (see Signing Secure Android apps and Signing Secure iOS apps)

How to Implement Detect BlankBot Malware in Android Apps Using Appdome

On Appdome, follow these simple steps to create self-defending Android Apps that Detect BlankBot Malware without an SDK or gateway:

1. Designate the Mobile App to be protected.

   1. Upload an app via the Appdome Mobile Defense platform GUI or via Appdome’s DEV-API or CI/CD Plugins.

   2. Android Formats: .apk or .aab
   3. Detect BlankBot Malware is compatible with: Java, JS, C++, C#, Kotlin, Flutter, React Native, Unity, Xamarin, Cordova and other Android apps.

2. Select the defense: Detect BlankBot Malware.

   1. Create and name the Fusion Set (security template) that will contain the Detect BlankBot Malware feature as shown below:
      

      Figure 1: Fusion Set that will contain the Detect BlankBot Malware feature
      

      1. Follow the steps in Sections 2.2-2.2.2 of this article to add the Detect BlankBot Malware feature to your Fusion Set via the Appdome Console.

      2. When you enable Detect Bank Trojan Apps you'll notice that the Fusion Set you created in step 2.1 now bears the icon of the protection category that contains Detect BlankBot Malware.

         

         Figure 2: Fusion Set that displays the newly added Detect BlankBot Malware protection
         Note: Annotating the Fusion Set to identify the protection(s) selected is optional only (not mandatory).

      3. Open the Fusion Set Detail Summary by clicking the “...” symbol on the far-right corner of the Fusion Set. Copy the Fusion Set ID from the Fusion Set Detail Summary (as shown below):

         Figure 3: Fusion Set Detail Summary

      4. Follow the instructions below to use the Fusion Set ID inside any standard mobile DevOps or CI/CD toolkit like Bitrise, Jenkins, Travis, Team City, Circle CI or other system:

         1. Refer to the Appdome API Reference Guide for API building instructions.
         2. Look for sample APIs in Appdome’s GitHub Repository.

   2. Add the Detect BlankBot Malware feature to your security template.

      1. Navigate to Build > Anti ATO tab > Android Trojans section in the Appdome Console.

         Like all other options in ONEShield™, Detect BlankBot Malware is turned on by default, as shown below:

         Figure 4: Selecting Detect BlankBot Malware
         Note: The App Compromise Notification contains an easy to follow default remediation path for the mobile app end user. You can customize this message as required to achieve brand specific support, workflow or other messaging.

      Toggle On Detect Bank Trojan Apps > Detect BlankBot Malware.
      Note: The checkmark feature Detect BlankBot Malware is enabled by default, as shown below.

      Figure 4: Selecting Detect BlankBot Malware

   3. Initiate the build command either by clicking Build My App at the bottom of the Build Workflow (shown in Figure 4) or via your CI/CD as described in Section 2.1.4.

   Congratulations!  The Detect BlankBot Malware protection is now added to the mobile app

3. Certify the Detect BlankBot Malware feature in Android Apps

   After building Detect BlankBot Malware, Appdome generates a Certified Secure™ certificate to guarantee that the Detect BlankBot Malware protection has been added and is protecting the app. To verify that the Detect BlankBot Malware protection has been added to the mobile app, locate the protection in the Certified Secure™ certificate as shown below:

   Figure 5: Certified Secure™ certificate

   Each Certified Secure™ certificate provides DevOps and DevSecOps organizations the entire workflow summary, audit trail of each build, and proof of protection that Detect BlankBot Malware has been added to each Android app. Certified Secure provides instant and in-line DevSecOps compliance certification that Detect BlankBot Malware and other mobile app security features are in each build of the mobile app.