I'm working on an Android application with few millions of users. The app has some financial|payment features. We have some public APIs and some authenticated ones (OAuth2). As a part of enhancing our security, we are currently using "Certificate Pinning".
The problem is, our app gets repackaged by some people to disable its advertisements, and unfortunately, some (unignorable number of) users install them.
We decided to reject the requests coming from these repackaged apps (not solely because of ads problem). I searched and came onto "Mobile Attestation" and
SafetyNet feature in Android, but this one needs Google Play Services which rules it out.
I'm wondering whether sending the SHA256 of APK signature (using PackageManager methods) as an HTTP header and rejecting the requests with unmatched HASHs is enough for this situation? Has anyone had similar experiences? What pitfalls and gotchas could exist? We are currently only on Android but Web/iOS clients are on the plan. Could this solution be extended to them?