0

I understand that apps are signed by both Google and the developer.

How do I detect if an apk is from the Play Store or if it is sideloaded.

I'd prefer if the method worked on all major platform only if possible including Android itself.

Even if sideloaded I'd like to know the source of the app. Like is it from Play Store.

I'm thinking of using an app or method that uses signature detection.

  • 1
    Signature detection doesn't help much to detect how an app was installed. But there's the "installerPackageName" property which tells you that when using adb dumpsys package (it carries the package name of the app having installed it, which would be the playstore's when that was used, or F-Droids, etc., or "unknown source" when completely side-loaded. – Izzy Jun 10 '16 at 6:40
  • @Izzy I'm more concerned with dealing with the apk itself. If you use an apk grabber or adb it is irrelevant wether the apk is sideloaded. I want verification that it is from Play store. – Wally Jun 10 '16 at 7:02
1

You cannot tell if the .apk originally came from Playstore – but you can tell whether it matches the one available at Playstore. Here's what you need:

  • the .apk in question
  • the .apk of the same app in the same version from Playstore
  • openssl

Unzip both .apk (each into its own directory), and compare their certificates (stored in the META-INF/ directory. Details on a thorough comparision can e.g. be found here. The command you'd need is:

openssl pkcs7 -inform DER -in META-INF/CERT.RSA -noout -print_certs -text

Alternatively, if you haven't openssl installed but the Oracle JDK:

keytool -printcert -file META-INF/CERT.RSA

or

jarsigner -verify -certs -verbose ../Example.apk

If the certificates match, both APK files where signed using the same key. Unless the dev's key got compromised, that should mean the potentially sideloaded APK should be fine (no guarantees the dev himself didn't play games – but if size and MD5 of the APK also match, I'd say it's safe).

  • While the part about comparing the signature in the META-INF is useful, the only way to be sure that an APK is the same as the Play Store's, is to compare their MD5 checksums, as you said. In fact, the tool named apktool contains an alpha setting to try and recompile an APK, and retaining the original signature in the process, so checking only the RSA may prove to be unreliable in the future. – Death Mask Salesman Jun 10 '16 at 8:02
  • @DeathMaskSalesman that's why I used that "conjunctivitis" (should..should). Another point is: an MD5 mismatch must not necessarily point to a compromised key. Some devs have their apps in different variants carrying the same version number (think e.g. of Tasker): due to restrictions in Playstore, they offer a "full fledged version" (with options Playstore would reject) via a different channel. – Izzy Jun 10 '16 at 9:23
  • 1
    Correct. So, the only way to be almost sure would be to check both signature and checksum, as you already said. – Death Mask Salesman Jun 10 '16 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.