4

I am working on a school research project about the Janus vulnerability (CVE-2017-13156).

Janus is a vulnerability of the signature scheme v1 while installing APKs. I know this does not correspond directly to the Android version, but I would like to make a statement in the text of my project, that says something like "Janus is a vulnerability that affects Android versions ABC to XYZ". I was researching the vulnerable versions and I found a small inconsistency between the Guardsquare Janus writeup and the CVE record:

  • Guardsquare says that Android versions 5.0 and newer are vulnerable and that apps using signature scheme v2 on Android 7 and higher are safe.
  • The CVE records lists the vulnerable versions as following: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 (notice that 5.0 is not on the list).

I decided to make an experiment with Android Studio Emulator to find out which of the vulnerable version lists is correct: I created a simple app that puts some text in the TextView in its Main Activity and I signed the APK with v1 scheme only (APK compiled for API level 19). I disassembled the APK using APKtool, then I changed the TextView text in the Smali files, compiled it back and prepended its DEX file to the original APK (standard way to exploit Janus).

I attempted to install this Janus-forged APK on various Android versions . The results are following:

  • Android 4.4: printed this message while attempting to install:
attacked.apk: 1 file pushed. 40.0 MB/s (3378792 bytes in 0.080s)
WARNING: linker: libdvm.so has text relocations. This is wasting memory and is a security risk. Please fix.
pkg: /data/local/tmp/attacked.apk
Failure [INSTALL_FAILED_INVALID_APK]
  • Android 5.0-7.0: The installation was successful, the installed app was showing the text manually edited in the Smali files.
  • Android 8.0 and 8.1: Show the error message:
Performing Streamed Install
adb: failed to install attacked.apk: 
Failure [INSTALL_PARSE_FAILED_UNEXPECTED_EXCEPTION: 
Failed to parse /data/app/vmdl173040809.tmp/base.apk: AndroidManifest.xml]

My questions here regard the error messages as I don't understand why they show up (I googled some possible reasons, but they didn't really fit my case).

My questions are:

  1. Why are Android versions older than 5.0 safe if they use signature scheme v1 as well? Why does Android 4.4 say the APK is invalid, but Android 5.0 does not?

  2. What does the error message of Android 8.0 and 8.1 mean? Is there a better APK check in Android 8 that reveals Janus even for APKs signed with signature scheme v1 only?

Thank you for your help!

  • Apps with v1 signature exploit bugs (like master key and janus exploits) cannot be installed on Android 7.+ Source: engineering.case.edu/groups/xusheng-xiao/sites/… – M. Abdelhafid Nov 19 '19 at 18:54
  • 1
    Thank you for the paper recommendation, it's a useful reference for me. However, even this paper mentions Janus being present on Android 5.1.1 to 8.0 -- they even cite the same CVE record as me. APKs with v1 can be installed on 7.x -- I managed to install my forged APK on 7.0 successfuly. What they mention in the paper are APKs with rollback protection issues -- you can sign your APK with both v1 and v2 and rollback protection issue means i.e. that your APK has indicated that it has both, but only v1 was found (not my case). So even though you helped, my two questions still lack an answer. – Topper Harley Nov 19 '19 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.