0

I understand that apps are signed by both Google and the developer.

How do I detect if an apk is from the Play Store or if it is sideloaded.

I'd prefer if the method worked on all major platform only if possible including Android itself.

Even if sideloaded I'd like to know the source of the app. Like is it from Play Store.

I'm thinking of using an app or method that uses signature detection.

Improve this question
2
  • 1
    Signature detection doesn't help much to detect how an app was installed. But there's the "installerPackageName" property which tells you that when using adb dumpsys package (it carries the package name of the app having installed it, which would be the playstore's when that was used, or F-Droids, etc., or "unknown source" when completely side-loaded.
    – Izzy
    Commented Jun 10, 2016 at 6:40
  • @Izzy I'm more concerned with dealing with the apk itself. If you use an apk grabber or adb it is irrelevant wether the apk is sideloaded. I want verification that it is from Play store.
    – Wally
    Commented Jun 10, 2016 at 7:02

1 Answer 1

Reset to default
2

You cannot tell if the .apk originally came from Playstore – but you can tell whether it matches the one available at Playstore. Here's what you need:

  • the .apk in question
  • the .apk of the same app in the same version from Playstore
  • openssl

Unzip both .apk (each into its own directory), and compare their certificates (stored in the META-INF/ directory. Details on a thorough comparision can e.g. be found here. The command you'd need is:

openssl pkcs7 -inform DER -in META-INF/CERT.RSA -noout -print_certs -text

Alternatively, if you haven't openssl installed but the Oracle JDK:

keytool -printcert -file META-INF/CERT.RSA

or

jarsigner -verify -certs -verbose ../Example.apk

If the certificates match, both APK files where signed using the same key. Unless the dev's key got compromised, that should mean the potentially sideloaded APK should be fine (no guarantees the dev himself didn't play games – but if size and MD5 of the APK also match, I'd say it's safe).

Improve this answer
3
  • While the part about comparing the signature in the META-INF is useful, the only way to be sure that an APK is the same as the Play Store's, is to compare their MD5 checksums, as you said. In fact, the tool named apktool contains an alpha setting to try and recompile an APK, and retaining the original signature in the process, so checking only the RSA may prove to be unreliable in the future.
    – Grimoire
    Commented Jun 10, 2016 at 8:02
  • @DeathMaskSalesman that's why I used that "conjunctivitis" (should..should). Another point is: an MD5 mismatch must not necessarily point to a compromised key. Some devs have their apps in different variants carrying the same version number (think e.g. of Tasker): due to restrictions in Playstore, they offer a "full fledged version" (with options Playstore would reject) via a different channel.
    – Izzy
    Commented Jun 10, 2016 at 9:23
  • 1
    Correct. So, the only way to be almost sure would be to check both signature and checksum, as you already said.
    – Grimoire
    Commented Jun 10, 2016 at 9:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .