Is it possible to someone de-compile an Android apk of a legitimate application and inject a malicious code, recompile and distribute? Our company's IT people deployed some apps into our mobile phones (BYOD) and I am bit concerned about it.

  • Thanks for the answer. The thing is , these applications are installed by our IT department. Hence , we cannot verify these or uninstall these. – Hendrix Nagoya Mar 15 '17 at 9:34

Possible yes, but it would not install as the same app. Also most (all?) apps on Google Play are signed with a certificate with vouches for authenticity.

An example: They take the official YouTube-App, modify it and replace the real YouTube-App on your device with their fake. In Google Play, the app will show as "Not installed" and you may install the real one parallel to the fake one. The reason is the different signature and maybe different package names.

| improve this answer | |

Confirming what DBX12 said, all android packages (APK) must have been signed to be installed in an Android device: "Android requires that all APKs be digitally signed with a certificate before they can be installed. "App Signing in Android Developer

Being so, a simple way to find out if the IT guys have injected code into a known application from Google Play is to compare the signature from the sample contained in your phones with the APK from Play Store.

Since the private-key for signing the application from the original developers can't be reproduced by your IT team and to modify any file in the package it must be re-signed, comparing the signatures is an effective method. Check How can I verify the authenticity of an APK file I downloaded? on Android StackExchange for hints on that.

| improve this answer | |

It is possible that your IT people inject malicious code and deploy the apps to your devices. The best way to analyse this is doing static and dynamic analysis of your application. I do not know whether you have the technical capability to do this but following is what you can do to analyze your newly installed apps.

Get the apk from your IT department ( if not you have to root your device and get the apk. Rooting is not a good practice though ).

Unzip the apk file (it is just a zip file with different extension). De-compile the unzipped .dex using tool such as dex2jar. This will give you a jar file. Use a tool such as JD-GUI to analyze the java files. You can get the Android permission levels in the manifest file and can analyze the source code to find if there are any data uploads etc..

Dynamic analysis is bit more complex than this and it is involving some more tools such as Wireshark and analyzing external communications etc..

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.