Lesson 2.54: App signing and repackaged copies
Anyone can take an APK, add code, and sign it again with their own key. The copy keeps the original's name, icon and version, so on a download site it looks identical, but its signature can't match the developer's. A customer has reported a 'Premium' Northwind Shop from a free-download site that unlocks discounts. In the lab you compare it with the official build: different hashes, the same identity, a different signing certificate (a well-known public test key), two extra SMS permissions, and new code that forwards text messages to a remote server. Then you plan the response.
17 min
You will learn to
- Explain what an app signature proves
- Compare file hashes and app identity
- Compare signing certificates with apksigner
- Spot added permissions and code
- Plan the response to a repackaged app
Key terms
- Signing certificate
- The developer's certificate whose key signs the APK; Android ties an app's identity and updates to it.
- APK Signature Scheme v2/v3
- Signatures over the whole file; any change breaks them.
- Repackaging
- Decoding an app, changing it and re-signing it with a different key.
- Play App Signing
- Google keeps the app's signing key and signs store builds; the team uses an upload key.
- Integrity check
- A server-verified check that the running app is the genuine, unmodified one.
← Malicious attachments · All lessons · Subnets and CIDR: dividing a network →