6

Can play store applications be tampered with by Google?

I understand that other apps are "unsigned" so you need to have applications from unknown sources turned on.

However, Google Apps are "signed" meaning the Android device sees them as genuine and from a trusted source.

Does this mean Google has some ability to tamper with the apk when it has been uploaded to the play store?

Thank you

Improve this question
3
  • Good question. I'm not into Android development that much but in my understanding when the developer doesn't use a well-known CA to sign it, it's actually self-signed and you'd need to trust Google that the APK and the certificate is not changed just for you. However someone could argue that you need the Google services installed to you phone in order to use the Play Store which is a more inconspicuous and higher-privileged backdoor than any app from the Play store.
    – Noir
    Commented Apr 12, 2016 at 9:24
  • 1
    Regardless of this tampering being possible or not, mind your threat model. If you're worried about google tampering the applications to do some malicious act, I want to remind you that you're using their operating system and they have the ultimate power to tamper with almost anything. (your inputs, your network traffic...)
    – Silverfox
    Commented Apr 12, 2016 at 11:27
  • @Silverfox The OS is developed mostly by Google but if you remove the Google services there's only the possibility of zero day vulnerabilities left which could be used to compromise your device.
    – Noir
    Commented Apr 12, 2016 at 12:47

1 Answer 1

Reset to default
3

According to the Android Developer Documentation:

Android requires that all apps be digitally signed with a certificate. [...] The certificate does not need to be signed by a certificate authority.

At least in my case - multiple apps with small user base - they are all self-signed.

For self-signed Apps a third party could tamper with the APK and self-sign it again. This would be quite hard to detect for the end-user. Stock-Android does not check if the Code-Signing-Certificate is trusted.

It just validates that - for example in case of an update - it's the same developer the two APKs come from:

If you publish an app to Google Play and then lose the key with which you signed your app, you will not be able to publish any updates to your app, since you must always sign all versions of your app with the same key.

As @Noir already stated in his comment: You already trust Google - you are using Android - so they already have all possibilities.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .