Chinese security bloggers have disclosed alternative to Bluebox’s Android signature attack. The new Chinese attack works instead by modifying the classes.dex file which contains an application’s compiled code within the APK file. When validating, a bug in the reading code means that 0xFFFD is converted to -3 and the validation takes places starting at the “dex” part of the file name extension which also happens to be the opening header of the dex file format. The flaw exploits a confusion between short and int types and has been given the bug id 9695860.”]
Source: http://www.h-online.com/security/news/item/Second-Android-signature-attack-disclosed-1918061.html