-1

I'm a developer of a mobile Android app. In my app, I've implemented code that reports the SHA-1 certificate fingerprint (implemented in Java code, as described in this post), in this way we can tell which users are using the real (Google Play signed) APK, and which are not.

Lately, i've stumbled across cases where users are using a modified APK, but this APK still reports the fingerprint of the genuine app (as signed by Google Play). We extracted the signature from the APK also using keytool as described in this post.

My question - is there any way a hacker could open the APK, modify it and then re-pack it and re-sign it so that it'll report the real fingerprint (apart from getting access to the signing key somehow) ?

Improve this question
New contributor
lysergic-acid is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
2
  • There may be confusion between the fingerprint of the signature of the APK, that you can check with a certificate and the fingerprint of the certificate used to sign here...
    – Bruno Rohée
    May 13 at 16:46
  • Generating the certificate fingerprint using keytool is outdated. I strongly recommend to only use apksigner instead. Also did the fingerprint match with the fingerprint from your official version? The fingerprint the app sends to your server can of course be faked (a manipulated app version can send any data it want to you).
    – Robert
    May 13 at 17:01

0

Reset to default

Your Answer

lysergic-acid is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.