Janus is a vulnerability of the signature scheme v1 while installing APKs. I know this does not correspond directly to the Android version, but I would like to make a statement in the text of my project, that says something like "Janus is a vulnerability that affects Android versions ABC to XYZ". I was researching the vulnerable versions and I found a small inconsistency between the Guardsquare Janus writeup and the CVE record:
- Guardsquare says that Android versions 5.0 and newer are vulnerable and that apps using signature scheme v2 on Android 7 and higher are safe.
- The CVE records lists the vulnerable versions as following: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 (notice that 5.0 is not on the list).
I decided to make an experiment with Android Studio Emulator to find out which of the vulnerable version lists is correct: I created a simple app that puts some text in the
TextView in its Main Activity and I signed the APK with v1 scheme only (APK compiled for API level 19). I disassembled the APK using
APKtool, then I changed the
TextView text in the Smali files, compiled it back and prepended its DEX file to the original APK (standard way to exploit Janus).
I attempted to install this Janus-forged APK on various Android versions . The results are following:
- Android 4.4: printed this message while attempting to install:
attacked.apk: 1 file pushed. 40.0 MB/s (3378792 bytes in 0.080s)
WARNING: linker: libdvm.so has text relocations. This is wasting memory and is a security risk. Please fix.
- Android 5.0-7.0: The installation was successful, the installed app was showing the text manually edited in the Smali files.
- Android 8.0 and 8.1: Show the error message:
Performing Streamed Install
adb: failed to install attacked.apk:
Failed to parse /data/app/vmdl173040809.tmp/base.apk: AndroidManifest.xml]
My questions here regard the error messages as I don't understand why they show up (I googled some possible reasons, but they didn't really fit my case).
My questions are:
Why are Android versions older than 5.0 safe if they use signature scheme v1 as well? Why does Android 4.4 say the APK is invalid, but Android 5.0 does not?
What does the error message of Android 8.0 and 8.1 mean? Is there a better APK check in Android 8 that reveals Janus even for APKs signed with signature scheme v1 only?
Thank you for your help!