Blog | G5 Cyber Security

Can App Signatures Be Broken?

G5 Cyber Security

TL;DR

Yes, a signed mobile application can be altered, although it’s not simple and breaks the chain of trust. Attackers typically repackage the app with malicious code after compromising the signing key or exploiting vulnerabilities in the build process. Regular security checks, protecting your signing keys, and using robust build systems are vital.

How App Signatures Work

When you publish an app (Android APK or iOS IPA), it’s digitally signed with a unique certificate. This signature verifies:

If even one byte of the app changes after signing, the signature becomes invalid.

Ways an App Can Be Altered After Signing

  1. Compromised Signing Key: This is the worst-case scenario. If an attacker gains access to your private key, they can sign their own malicious versions of your app.
    • Prevention: Store signing keys securely (Hardware Security Modules – HSMs are best). Limit access strictly. Rotate keys periodically.
  2. Repackaging (Android): Android apps (APKs) are essentially ZIP files. Attackers can:
    • Decompile the APK using tools like apktool. 
      apktool d your_app.apk
    • Modify the decompiled resources and code.
    • Rebuild the APK. 
      apktool b your_app -o new_app.apk
    • Sign the repackaged APK with their own key (or, if they’ve compromised yours, your key).
  3. Binary Patching: Attackers can directly modify the app’s executable code.
    • This requires advanced skills and knowledge of the app’s architecture.
    • Tools like disassemblers (e.g., IDA Pro) are used to find and change instructions.
  4. Exploiting Build System Vulnerabilities: If your build process has weaknesses, attackers might inject malicious code during the build.
    • Ensure secure CI/CD pipelines.
    • Use tamper-proof build environments.
  5. Dynamic Instrumentation (Runtime Manipulation): Tools like Frida allow attackers to modify app behaviour at runtime without altering the APK file itself. This is often used for testing but can be abused.
    • This doesn’t change the signature, but it alters how the app functions.

Detecting Alterations

  1. App Store Checks: Both Google Play and Apple App Store perform checks to verify signatures.
    • However, these aren’t foolproof; they primarily detect obvious signature mismatches.
  2. Root/Jailbreak Detection: Implement code in your app to detect if the device is rooted (Android) or jailbroken (iOS). Altered apps are more likely on compromised devices.
    • Be aware that root/jailbreak detection can be bypassed.
  3. Integrity Checks: Include checksums or hashes of critical app components and verify them at runtime.
    • If the hash doesn’t match, it indicates tampering.
  4. Code Obfuscation & Tamper Detection Libraries: Use tools to make your code harder to reverse engineer and detect modifications.
    • Examples include ProGuard (Android) and DexGuard.
  5. Regular Security Audits: Have security professionals review your app’s code and build process for vulnerabilities.

Protecting Your App

Exit mobile version