3

I'm playing a game that is developed by a sub-division of Google. (Ingress/Niantic)

Usually new versions of this game pushed out through staged roll-outs, which means if you are not one of the lucky ones you have to wait a while to get the new version with sometimes cool new features.

Of course, the APK files for the new version could be found all over the internet on various sites. This naturally leads to two things:

  • There are APK files that are tempered with
  • Players get banned for using an unofficial version of the game.

As a curious player I want to have the new versions as soon as possible. To verify I'll have an valid build a downloaded the APK from the previous version, that I installed through Google Play, to my computer via adb.

$ adb pull /data/app/com.package.name
$ unzip -p com.package.name-1.apk META-INF/CERT.RSA | keytool -printcert | grep MD5

Which gives me:

MD5:  A7:E9:93:81:E9:F2:10:0E:48:39:AB:48:34:F3:93:67

Now to do the same with the APK for the new version that I downloaded somewhere from the internet and the MD5 of the certificate matches the one from the official older APK.

My question are now:

  • Is it safe to assume this is a valid APK that is not tempered with?
  • Is is possible for Google to detect that I installed the new version of the app not through the Play Store?
  • Could they somehow detect the unofficial update from within the app. For example through the Application Licensing service?
0

I used to play Ingress before, and I was able to update to newer versions using APKs uploaded by other players. I don't know if Google's verification process has changed, but as long as it's an official APK (i.e. not modified), it should be fine.

Also, according to this Google+ thread, the verification process uses Google Play Services.

  • 2
    I stumbled upon this when researching. In the end my question boils down to: Is it possible to detect a manually updated app from a Play Store updated app via the Google Play Services. – TheHippo May 6 '14 at 16:03
  • @TheHippo When you install an app that is not from the Play Store, it is not linked to the Play Store. Therefore, it won't detect updates for that app. However, I think your Ingress log-in account will still be verified by Google, if it's legit. – geffchang May 6 '14 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.