0

I have this code (copied it from here: https://www.airpair.com/android/posts/adding-tampering-detection-to-your-android-app) to add tampering protection to my Android application.

It is possible to submit an application to the Play Store with multiple signatures?

Should I also validate that the method packageInfo.signatures only returns one signature? Or an apk can have multiple signatures and all of them valid?

private static final int VALID = 0;
private static final int INVALID = 1;

public static int checkAppSignature(Context context) {

    try {
        PackageInfo packageInfo = context.getPackageManager().getPackageInfo(context.getPackageName(), PackageManager.GET\_SIGNATURES);

        for (Signature signature : packageInfo.signatures) {
            byte[] signatureBytes = signature.toByteArray();
            MessageDigest md = MessageDigest.getInstance("SHA");
            md.update(signature.toByteArray());
            final String currentSignature = Base64.encodeToString(md.digest(), Base64.DEFAULT);

            //compare signatures
            if (SIGNATURE.equals(currentSignature)){
                return VALID;
            };
        }
    } catch (Exception e) {
        //assumes an issue in checking signature., but we let the caller decide on what to do.
    }

    return INVALID;
}
Sandro Machado
  • 9,921
  • 4
  • 36
  • 57
  • 2
    I don't know of any common scenario in which a single APK will have more than one signature. It used to be that Android only paid attention to the first one; now all signatures must match for an APK to be considered an upgrade to an installed app. That being said, your tamper detection is all but useless. Anyone tampering with your app will simply tamper with this method to have it return `VALID`. – CommonsWare Jan 06 '16 at 00:46
  • I know that this can be easily hacked, but it is just one more protection. – Sandro Machado Jan 06 '16 at 00:48
  • About the signature, I am afraid that an APK submitted to the Play Store can possible be resigned by the Play Store (for a reason that I cannot explain :)) and with that, the method `packageInfo.signatures` returns two elements. I am just trying to find a case where this can happens. – Sandro Machado Jan 06 '16 at 00:56
  • @CommonsWare can you have a look at my question? https://stackoverflow.com/questions/45592412/avoiding-tampering-in-android-applications , I would appreciate your help – Ricardo Aug 09 '17 at 13:42

0 Answers0