Description

Identifies Android applications that are not properly signed with a digital signature. Unsigned APKs can be modified and redistributed by attackers, compromising application integrity and enabling malicious code injection. This poses significant security risks as Android's security model relies on APK signatures to verify authenticity.

Detection Strategy

• Examines the APK file for presence of signature files (META-INF/*.RSA, *.DSA, or *.EC)

• Verifies if the APK contains valid signature blocks for Android signing schemes (v1, v2, or v3)

• Reports a vulnerability if the APK lacks valid signature files or signature blocks

• Checks if existing signatures are properly formatted and contain valid certificate chains