Android-SigMorph: Covert Communication Exploiting Android Signing Schemes
summary
Demonstrates how V2/V3 signing leaves unprotected regions inside the APK signing block so a signed APK can be modified in hex without breaking its signature, e.g. changing the VAR padding block or the central directory offset to append megabytes of data. Uses APK signer and a hex editor, shows a live code-bomb that a benign app reads by offset, and measures detection impact: bloating a 64 KB Pegasus sample and embedding malware in the signing block drops VirusTotal detections dramatically.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 3:18Android signing schemes overview
- 11:32V2 signing scheme details
- 16:11Optional APK signing blocks
- 22:33Demo modifying APK in hex
- 27:36Techniques to modify V2 signed APK
- 30:04Legitimate uses of APK modification
- 32:34Malicious use cases for APK modification
- 37:30Android V4 signing scheme and defenses
- 39:17Future research and takeaways
related talks
47mAttacking Android Applications
37mThe Art of Hiding Sensitive Info in Plain Sight
28mSecure Development whit Android
43mAttacking Android Applications
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
42mAttack & Defend Mobile Apps
47mSecuring Android Applications
32mHacking the Hackers’ Code: Inside Android Malware