• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Apps android apps - integrity check

jpal

Lurker
If someone tampers with an installed android app (apk file), are there any checks done at the time of launching to ensure integrity of an app is not compromised? As I understand there are no checks performed at launch time and I am trying to do the following:
I am trying to compute SHA-1 digests of the installed applications (apk file). I am aware that an apk file is like a zip file. It consists of other files. However, I am treating it as any other file (just a stream of bytes) and trying to compute SHA-1 digests of all the apk files. Are there any problems with this approach? The following code kept on giving null exception:
private static byte[] getSHA1FromFileContent(String filename) {

try
{
MessageDigest digest = MessageDigest.getInstance("SHA-1");
//byte[] buffer = new byte[65536]; //created at start.
final FileInputStream fis = new FileInputStream(filename);
int n = 0;
byte[] buffer = null;
while (n != -1)
{
n = fis.read(buffer);
if (n > 0)
{
digest.update(buffer, 0, n);
}
}
byte[] digestResult = digest.digest();
return digestResult;
}
catch (Exception e)
{
return null;
}
}

As an alternative when I attempted to retrieve the files from the apk file and save the individual files as follows, I again kept on null exception

public void unzip()
{
try
{
FileInputStream fin = new FileInputStream(_zipFile);
ZipInputStream zin = new ZipInputStream(fin);
ZipEntry ze = null;
while ((ze = zin.getNextEntry()) != null)
{
Log.v("Decompress", "Unzipping " + ze.getName());

if(ze.isDirectory()) {
_dirChecker(ze.getName());
} else {
File dstfile = new File(_location + ze.getName());
dstfile.createNewFile();
FileOutputStream fout = new FileOutputStream(dstfile.getPath());
//OutputStream out = openFileOutput(_location + ze.getName(), Context.MODE_PRIVATE);
for (int c = zin.read(); c != -1; c = zin.read()) {
fout.write(c);
}

zin.closeEntry();
fout.close();
}

}
zin.close();
}
catch(Exception e)
{
Log.e("Decompress", "unzip", e);
}
}
I am also verifying the application configuration by way of - PreferencesManager.getDefaultSharedPreferences call providing the package name of the application as input parameter
In order to verify the integrity of an installed application is the above check enough?
android
 
Welcome to AF :)

There are two problems, one is verifying a digest of an application changes it's digest.

The other method, getting the package name, can be spoofed by a clever enough hacker.

Basically it sounds like you are doing a CRC. However the CRC value needs to be stored on a server or somwhere outside the app. Or you need to do a CRC/or digest on only a part of the app. But then it's hard to tell if the app has been tampered with.

Ultimately the most secure method of anti-tamper would be to use LVL and to forward the signed LVL server response to your own private trusted server to verify. Then your server can decided to server content to the app. (not just tell the app everything is ok) this way you have some content kept away from the app that is secure. If the server detects tampering or a bad license, it can decide not to serve your app any text or images or something.

Basically, never ever trust the client and nothing is 100% secure.

Read more here:
Android Developers Blog: Securing Android LVL Applications
 
Back
Top Bottom