1

Many people (including me) are downloading/installing/updating applications in public networks where we cant be sure of a secure connection without MiTM attacks, does Google's Play Store transmit the APK files over HTTPS? And does it verify its checksums after the download before its installed?

Improve this question

1 Answer 1

Reset to default
4

Android itself checks the certificate when you update already installed APKs. It's therefore not possible to install a tampered/modified app that would need to be signed with a different certificate. It would throw a certificate mismatch exception. Using Google Play to install a new APK for the first time is different somehow: It's signed with the developers key, but Google or a man in the middle could tamper the connection, modify it and then send it to you with a new signature. The package installer and android itself doesn't check back with google if the signature matches. But Google Play implements the security recommendations that google gives for developers: It uses SSL and should be therefore secure. Unfortunately a wrong implementation can lead to flawed security as it happened with many apps that were tested for SSL vulnerability in this study:

http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf

(Not including Google Play)

Still the signature check itself is still vunrenable in 4.4: http://www.zdnet.com/kitkat-gets-fix-for-android-app-tampering-bug-but-earlier-versions-still-vulnerable-7000022930/

Improve this answer
6
  • Are the certificates for each app the same during the lifetime of it or can they be changed?
    – user36976
    Jul 1, 2014 at 12:54
  • @Nick: They cannot be changed. Once you've uploaded an app for the first time to Google Play, you have to continue using the same signing key for the lifetime of the app. It will not allow you to upload an update that is signed differently.
    – eldarerathis
    Jul 1, 2014 at 15:01
  • @eldarerathis And what happens if the signing key is compromised then?
    – user36976
    Jul 1, 2014 at 15:19
  • @Nick Then whoever stole it could upload whatever they wanted. The same is true of everything else on the Internet that is "secure", though. The underpinnings of Internet encryption rely on private keys remaining private. If that's an attack vector you're concerned about, then you'd have to basically avoid anything that relies on asymmetric encryption.
    – eldarerathis
    Jul 1, 2014 at 15:54
  • So TLDR: Just do the initial installation at home then you're fine
    – user36976
    Jul 1, 2014 at 20:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .