Nathan Collier

Leading expert in classification of Android malware using complex, high quality signatures to classify large samplesets

• Creating the highest detections per signature seen on Android customers devices

Working diligently with customers to resolve tough issues

• Beyond being main contact for forum support for all things Android, I also assist with arduous cases submitted via our support staff

Creator and maintainer of the Mobile Malware Intel System

• The Mobile Malware Intel System is the genius behind our high efficiency of classifying malware with a limited number of staff members

  • This system contains millions of Android malware samples

• An Android malware classification system made by a researcher, for researchers

  • Over half million signatures created in the system to combat Android malware

• It is a complex system involving Amazon EC2 running Ubuntu server, Amazon RDS running MySQL, and python scripts

• Being the single contact of the development on the Mobile Malware Intel System creates a space of high agility among the Android protection team

• Key components

  • Multi-threaded APK Processors

    • Processes thousands of incoming APKs per day

    • Uses androguard and many other tools to analyze Android malware

    • Android malware samples are broken down into data points and sent to Mobile Malware Intel database

  • APK Classifiers

    • Classifies malware in our Mobile Malware Intel database to sort what needs to be worked on or not

  • Insert Signatures

    • Inserts signatures into our Mobile Malware Intel database to classify malware

  • Update Signatures

    • Updates signatures when modifications is required

  • Create Sig File

    • Creates signature files to be download on customer devices

    • Performs FP check before creation of signature files

    • Signature files are packaged and turned into Malware Database to be released onto Malwarebytes for Android clients

  • Auto Detector

    • Automatically creates signatures to classify malware, leaving only the toughest malware samples to us experts

  • Various other scripts to do a multitude of things, and always scripting to be on the leading edge

Contributor to Malwarebytes Labs generating some of the highest viewed blogs on the site

• In addition, working with PR on requests from leading news outlets

• Contributor to yearly State of Malware report

Going beyond core responsibilities

• Performing QA work to resolve client issues

  • Detailed steps to reproduce issues

• Scripting using Windows Batch and WinSCP to assist automation of Malware Database releases onto Malwarebytes for Android clients

  • Use of Jenkins to automate the process

• Training and mentoring the best Android malware researchers in the industry

  • Creating easy to understand training documentation including efficient workflow chart

• Documenting incident response procedures such as a simplified method for anyone to follow on how to resolve a Android False Positive (FP)

Forefront on the battle against pre-installed malware

• Creation of tutorial on how to remove pre-installed malware

• Blowing the whistle on United States government-funded phones that come pre-installed with malware

• Working internally on how to address pre-installed malware

Founding member of the Coalition Against Stalkerware

• Fiercely fighting against stalkerware on Android devices

• Adding over hundred detections created that no other vendors detected