Dearming Android Apps at Install Time: The StegoDefender Case: IEEE CNS 25 Poster

We argue that today's prevailing detection-centric view of Android security should be complemented with a proactive dearming paradigm: through installation-time app sanitization, potentially malicious resources could be neutralized before installation, rendering any concealed payloads non-functional while preserving benign app behavior. However, what sounds straight-forward in principle is far from trivial in practice, especially on Android, whose unique operating system characteristics make such proactive transformations particularly challenging. To provide a tangible proof of concept, we present a concrete use case: we design and implement StegoDefender, a dearming prototype specifically targeting stegomalware potentially embedded in app images. We integrate image-dearming functionalities into a fully Android-compliant installation workflow and demonstrate that, among various possible image-dearming techniques, rescaling-based transformations neutralized over 99.998% of embedded payloads without affecting benign apps. These results provide strong evidence that dearming at installation-time is a feasible and practical defense strategy.