update: reject APKs with invalid file sig, probably Janus exploits

Browse source

This just checks the first four bytes of the APK file, aka the "file
signature", to make sure it is the ZIP signature and not the DEX signature.
This was checked against the test APK, and I ran it against some known
malware and all of f-droid.org to make sure it works.

All valid ZIP files (therefore APK files) should start with the ZIP
Local File Header of four bytes.

https://www.guardsquare.com/en/blog/new-android-vulnerability-allows-attackers-modify-apps-without-affecting-their-signatures

...

This commit is contained in:

Hans-Christoph Steiner 2017-12-11 18:36:21 +01:00

parent 5ce950e748

commit bde0558d82

4 changed files with 40 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

BIN

tests/janus.apk Normal file

View file

Binary file not shown.