Should we also check for the number of signatures on Android tampering detection -
i have code (copied here: https://www.airpair.com/android/posts/adding-tampering-detection-to-your-android-app) add tampering protection android application.
it possible submit application play store multiple signatures?
should validate method packageinfo.signatures returns 1 signature? or apk can have multiple signatures , of them valid?
private static final int valid = 0; private static final int invalid = 1; public static int checkappsignature(context context) { try { packageinfo packageinfo = context.getpackagemanager().getpackageinfo(context.getpackagename(), packagemanager.get\_signatures); (signature signature : packageinfo.signatures) { byte[] signaturebytes = signature.tobytearray(); messagedigest md = messagedigest.getinstance("sha"); md.update(signature.tobytearray()); final string currentsignature = base64.encodetostring(md.digest(), base64.default); //compare signatures if (signature.equals(currentsignature)){ return valid; }; } } catch (exception e) { //assumes issue in checking signature., let caller decide on do. } return invalid; }
Comments
Post a Comment