Many people (including me) are downloading/installing/updating applications in public networks where we cant be sure of a secure connection without MiTM attacks, does Google's Play Store transmit the APK files over HTTPS? And does it verify its checksums after the download before its installed?
Android itself checks the certificate when you update already installed APKs. It's therefore not possible to install a tampered/modified app that would need to be signed with a different certificate. It would throw a certificate mismatch exception. Using Google Play to install a new APK for the first time is different somehow: It's signed with the developers key, but Google or a man in the middle could tamper the connection, modify it and then send it to you with a new signature. The package installer and android itself doesn't check back with google if the signature matches. But Google Play implements the security recommendations that google gives for developers: It uses SSL and should be therefore secure. Unfortunately a wrong implementation can lead to flawed security as it happened with many apps that were tested for SSL vulnerability in this study:
(Not including Google Play)
Still the signature check itself is still vunrenable in 4.4: http://www.zdnet.com/kitkat-gets-fix-for-android-app-tampering-bug-but-earlier-versions-still-vulnerable-7000022930/
|show 1 more comment|