  Android virtualization enables an app to create a virtual environment, in
which other apps can run. Originally designed to overcome the limitations of
mobile apps dimensions, malicious developers soon started exploiting this
technique to design novel attacks. As a consequence, researchers proposed new
defence mechanisms that enable apps to detect whether they are running in a
virtual environment. In this paper, we propose Mascara, the first attack that
exploits the virtualization technique in a new way, achieving the full
feasibility against any Android app and proving the ineffectiveness of existing
countermeasures. Mascara is executed by a malicious app, that looks like the
add-on of the victim app. As for any other add-on, our malicious one can be
installed as a standard Android app, but, after the installation, it launches
Mascara against the victim app. The malicious add-on is generated by Mascarer,
the framework we designed and developed to automate the whole process.
Concerning Mascara, we evaluated its effectiveness against three popular apps
(i.e., Telegram, Amazon Music and Alamo) and its capability to bypass existing
mechanisms for virtual environments detection. We analyzed the efficiency of
our attack by measuring the overhead introduced at runtime by the
virtualization technique and the compilation time required by Mascarer to
generate 100 malicious add-ons (i.e., less than 10 sec). Finally, we designed a
robust approach that detects virtual environments by inspecting the fields
values of ArtMethod data structures in the Android Runtime (ART) environment.
