Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Many people (including me) are downloading/installing/updating applications in public networks where we cant be sure of a secure connection without MiTM attacks, does Google's Play Store transmit the APK files over HTTPS? And does it verify its checksums after the download before its installed?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Android itself checks the certificate when you update already installed APKs. It's therefore not possible to install a tampered/modified app that would need to be signed with a different certificate. It would throw a certificate mismatch exception. Using Google Play to install a new APK for the first time is different somehow: It's signed with the developers key, but Google or a man in the middle could tamper the connection, modify it and then send it to you with a new signature. The package installer and android itself doesn't check back with google if the signature matches. But Google Play implements the security recommendations that google gives for developers: It uses SSL and should be therefore secure. Unfortunately a wrong implementation can lead to flawed security as it happened with many apps that were tested for SSL vulnerability in this study:

http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf

(Not including Google Play)

Still the signature check itself is still vunrenable in 4.4: http://www.zdnet.com/kitkat-gets-fix-for-android-app-tampering-bug-but-earlier-versions-still-vulnerable-7000022930/

share|improve this answer
    
Are the certificates for each app the same during the lifetime of it or can they be changed? –  Nick Jul 1 at 12:54
    
@Nick: They cannot be changed. Once you've uploaded an app for the first time to Google Play, you have to continue using the same signing key for the lifetime of the app. It will not allow you to upload an update that is signed differently. –  eldarerathis Jul 1 at 15:01
    
@eldarerathis And what happens if the signing key is compromised then? –  Nick Jul 1 at 15:19
    
@Nick Then whoever stole it could upload whatever they wanted. The same is true of everything else on the Internet that is "secure", though. The underpinnings of Internet encryption rely on private keys remaining private. If that's an attack vector you're concerned about, then you'd have to basically avoid anything that relies on asymmetric encryption. –  eldarerathis Jul 1 at 15:54
    
So TLDR: Just do the initial installation at home then you're fine –  Nick Jul 1 at 20:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.