  Android malware is a persistent threat to billions of users around the world.
As a countermeasure, Android malware detection systems are occasionally
implemented. However, these systems are often vulnerable to \emph{evasion
attacks}, in which an adversary manipulates malicious instances so that they
are misidentified as benign. In this paper, we launch various innovative
evasion attacks against several Android malware detection systems. The
vulnerability inherent to all of these systems is that they are part of
Androguard~\cite{desnos2011androguard}, a popular open source library used in
Android malware detection systems. Some of the detection systems decrease to a
0\% detection rate after the attack. Therefore, the use of open source
libraries in malware detection systems calls for caution.
  In addition, we present a novel evaluation scheme for evasion attack
generation that exploits the weak spots of known Android malware detection
systems. In so doing, we evaluate the functionality and maliciousness of the
manipulated instances created by our evasion attacks. We found variations in
both the maliciousness and functionality tests of our manipulated apps. We show
that non-functional apps, while considered malicious, do not threaten users and
are thus useless from an attacker's point of view. We conclude that evasion
attacks must be assessed for both functionality and maliciousness to evaluate
their impact, a step which is far from commonplace today.
