2

On my request, a developer gave me a new version of his Android app to test. The app requires root permissions.

I do not know the developer personally. I have no specific reasons to trust or distrust him/her.

How can I check the APK to best ensure it is safe?

Virustotal is a common site to check files, but it's unclear if it is appropriate or comprehensive for Android APK files.

2
  • 2
    A malware scanner won't help you, because it can only detect malware which is known to them. When the apk you are going to test is a newly developed malware, they won't be able to recognize it. – Philipp Feb 21 '15 at 1:37
  • That's my concern. – RockPaperLz- Mask it or Casket Feb 21 '15 at 2:02
2

You mention that the developer sells a public version of this application you were given. If you trust the public application then you can use androguard(androsim & androdiff) to figure out the similarity % between your new version and the public version.

If say, they are 95% similar then you only have 5% of the code to inspect. Then you can even see what specifically is different between the two apps and decide for yourself if the new code is malicious and if you'd like to use that app.

1

You could decompile the apk file using a variety of methods, one of which would be using apktool. Link here: https://code.google.com/p/android-apktool/wiki/ApktoolOptions

Do note that you will not get java code from the decompilation but smali code which is not as simple to read. You would need to look through the code and judge for yourself if the app is performing actions which could be deemed as malicious.

The simplest way though, is to request a copy of the source code from the developer and look through it. If satisfied, compile and package it yourself.

1
  • I sincerely appreciate your answer and the time you spent writing it. Unfortunately, I don't think that would work. Reading thousands of lines of uncommented code would take an inordinate amount of time. The author sells the public version of the app for profit, so I don't think he/she will want to give me all the source code. – RockPaperLz- Mask it or Casket Feb 21 '15 at 2:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.