6

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read something like Are you sure you want to allow <large block of code filling my screen>.

Immediately, the Redphone and Signal apps (both apps are for secure communication) started updating.

As a precaution, I restarted, uninstalled them, then reinstalled them from the Play store. After a while, they automatically "updated" again. This could be a coincidence, but it smells fishy to me.

Is there any way to verify the hash an app on Android? Could I have approved some adversary’s certificate or something? I run Cyanogenmod, if that matters.

I'm an activist and regularly attend protests but I never do anything exciting, so as far as threat models go I have no reason to believe anyone would give a hoot about my conversations. So it's probably nothing, but I'd like to have the peace of mind.

I'm sorry if this is answered already. I searched unsuccessfully, but it may be that I don't know the correct keywords to use.

  • Wiping the phone and reflashing Cyanogen will fix almost all infections. – Neil Smithline Nov 3 '15 at 21:39
  • Is your phone rooted? – thexacre Nov 4 '15 at 2:52
  • @thexacre - cyanogenmod is almost always an after market install that is always rooted so I'd assume yes. – Neil Smithline Nov 4 '15 at 2:54
  • @thexacre Yes it's rooted. – crypdick Nov 4 '15 at 19:11
  • 1
    @Richard Decal mail the company/developer and ask if they released any updates at all and ask for a hash for the APKs , you can easily send the apk to your PC using an file manger and then generate a hash from it so you can compare to the hash provided by the developer/company anyway just to be sure flash the bootloader , and OS again, and make an nand backup( don't remember now if this is the name) install firewalls, also nuke your PC from orbit , update the firmware of your router, remember : the infection might have already been spread to all your devices – Freedo Nov 6 '15 at 15:02
4

Since your apps were downloaded from Play Store, you can check their latest update date by simply visiting their store page:

  • From Play Store app: tap 'Read More' on app's description, scroll to the bottom and look for 'Updated on'
  • From browser: look for 'Additional Information' on the bottom, there's 'Updated' date.

For your case, both RedPhone and Signal are developed by same developer and updated on November 2 (as of current writing). I think it's really a coincidence, since I observe that Play Store's update timing is arbitrarily random.

If you're still unsure, you can check the APK file's hash by submitting the file on Virus Total. You need root access to locate the APK (the path will look like /data/app/<package name>/base.apk. The package name can be found on Play Store link). Also, you need to ask the correct hash from the developer for confirmation.

Additional note: Even if it was a case of MitM, Android app can only be updated if it uses the same certificate to sign the app. Failing that will result in failed update (with error message "Application not installed. An existing package by the same name with a conflicting signature is already installed.", or INSTALL_PARSE_FAILED_INCONSISTENT_CERTIFICATES on ADB). This won't happen, unless the attacker is the developer (possible, but unlikely for reputable developer), or the attacker has the certificate (unlikely, and a critical issue for developer).

| improve this answer | |
  • Unfortunately, I can't answer "Could I have approved some adversary’s certificate or something?" since I'm not an expert on network security... – Andrew T. Nov 9 '15 at 2:33
2

Android requires app updates to be signed by the same key as the original app. So unless the developers themselves have been compromised, a MITM won't be able to update existing apps. Note that this process is completely unrelated to SSL certificates. App signing certificates are self signed and don't rely on certificate authorities for trust.

It sounds like you just got a normal legitimate app from the Play Store.

| improve this answer | |
1

The only way to be sure, would be to get a forensic copy of the phone when it's in a "clean" state and then compare that to what you might classify as suspicious state. If you feel it's been pawned then I would recommend consulting with a forensics expert.

| improve this answer | |
  • If I don't keep snapshots of my phone state, would they be able to find anything? For what it's worth, I'm running a relatively fresh CM install (I just formatted and upgraded to the latest release 2 days ago). – crypdick Nov 4 '15 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.