Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
On my request, a developer gave me a new version of his Android app to test. The app requires root permissions.
I do not know the developer personally. I have no specific reasons to trust or distrust him/her.
How can I check the APK to best ensure it is safe?
Virustotal is a common site to check files, but it's unclear if it is appropriate or comprehensive for Android APK files.
You mention that the developer sells a public version of this application you were given. If you trust the public application then you can use androguard(androsim & androdiff) to figure out the similarity % between your new version and the public version.
If say, they are 95% similar then you only have 5% of the code to inspect. Then you can even see what specifically is different between the two apps and decide for yourself if the new code is malicious and if you'd like to use that app.
You could decompile the apk file using a variety of methods, one of which would be using apktool. Link here: https://code.google.com/p/android-apktool/wiki/ApktoolOptions
Do note that you will not get java code from the decompilation but smali code which is not as simple to read. You would need to look through the code and judge for yourself if the app is performing actions which could be deemed as malicious.
The simplest way though, is to request a copy of the source code from the developer and look through it. If satisfied, compile and package it yourself.
