Description

Identifies Android applications that are not properly signed with a digital signature. Unsigned APKs can be modified and redistributed by attackers, compromising application integrity and enabling malicious code injection. This poses significant security risks as Android's security model relies on APK signatures to verify authenticity.

Detection Strategy

• Examines the APK file for presence of signature files (META-INF/*.RSA, *.DSA, or *.EC, each with its .SF file)

• Checks if the APK contains signature blocks for the v2 or v3 signing schemes

• Reports a vulnerability if the APK has no v1, v2 or v3 signature