Google is ramping up Android security protection with new Android app safety tools

An Android phone being held in the hand
(Image credit: Shutterstock / mindea)

  • Android's security team partners with Mandiant FLARE for upgrade
  • The capa open source binary analysis tool is being enhanced
  • Gemini AI is being thrown in the mix, too

Google is ramping up its Android security protection with new app safety tools.

In a new blog post, Google’s Lin Chen announced the company’s Android Security and Privacy Team is partnering with Mandiant FLARE, to enhance the capa open source binary analysis tool. That way, the tool will be better at analyzing ARM ELF files, often used in Android malware.

Chen said this collaboration will help detect and highlight suspicious code behaviors in native files, enabling faster malware analysis and decision-making, with the help of Gemini AI.

Detecting malware in ELF

Describing how the new tools work, Chen shared a case study of an illegal gambling app disguised as a music app. This app, found on the Google Play Store, was secretly loading gambling websites for users in specific regions. It used different anti-analysis techniques (hiding key functions in a native ELF file, timezone detection, dynamic downloading and decryption of additional malicious code) to stay hidden in plain sight.

However, by leveraging static analysis and capa, Google's team identified these deceptive behaviors and successfully removed the app.

Capa detects malware capabilities in ELF files, and new rules have been developed specifically for Android, Chen further explained.

These rules identify behaviors like ptrace API calls (anti-debugging), extracting device and timezone info via JNI, downloading and decrypting code, using Base64 & Cipher API for encoding/encryption, allowing analysts to quickly locate suspicious functions, without needing to sift through mountains of obfuscated code.

Google also added Gemini AI to summarize the most suspicious functions highlighted by capa. The AI tool can do risk level assessments, insights into obfuscation, anti-debugging, and cloaking tactics, enabling a faster, and more effective, malware detection and rule-writing.

“Equipped with the fast-evolving Gemini, our analysts are able to spend less time on those sophisticated samples, minimising the exposure for malicious apps and ensuring the safety of Android ecosystems,” Chen concluded.

You might also like

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Read more
A hand reaching out to touch a futuristic rendering of an AI processor.
Google says Gemini is being misused to launch major cyberattacks
A hand reaching out to touch a futuristic rendering of an AI processor.
Google Cloud unveils new AI Protection security tools, no matter which model you use
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
An Android phone being held in the hand
These malicious Android apps were installed over 60 million times - here's how to stay safe
Malware worm
Coordinated global mobile malware campaign targets banking apps and cryptocurrency platforms
 In this photo illustration a Google Play logo seen displayed on a smartphone.
Over 2 million risky Android apps were blocked from the Play Store last year
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
EA Sports F1 25 promotional image featuring drivers Oscar Piastri, Carlos Sainz and Oliver Bearman.
F1 25 has been officially announced, with this year's entry marking a return for Braking Point and a 'significant overhaul' for My Team mode
Garmin clippd integration
Garmin's golf watches just got a big software integration upgrade to help you improve your game
Robert Downey Jr reveals himself as Doctor Doom to a delighted crowd at San Diego Comic-Con 2024
Marvel is currently revealing the full cast for Avengers: Doomsday, and I think it's going to be a long-winded announcement
Samsung QN90F on yellow background
Samsung announces US prices for its 2025 mini-LED TV lineup, and it’s good and bad news
Nintendo Switch Lite
Forget the Nintendo Switch 2, the original Switch is getting one last hurrah in a surprise Nintendo Direct tomorrow