23

I see the below error when I tried to verify, if the .apk (andriod application)is signed or not.

I'm not sure what this error exactly means?

Is this raises any security concerns ?

root@kali:~/Downloads# apksigner verify --verbose magni_v1.2.8_apkpure.com.apk 
Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Number of signers: 1
WARNING: META-INF/android.arch.core_runtime.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/android.arch.lifecycle_livedata-core.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/android.arch.lifecycle_runtime.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/android.arch.lifecycle_viewmodel.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-compat.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-core-ui.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-core-utils.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-fragment.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-media-compat.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/com.android.support_support-v4.version not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/rxjava.properties not protected by signature. Unauthorized modifications to this JAR entry will not be detected. Delete or move the entry outside of META-INF/.

Thanks

2
  • 1
    If this is someone else's app, not an app you're working on, this question would probably be better suited to Android Enthusiasts.
    – BSMP
    Aug 31, 2018 at 21:50
  • The warnings are only relevant of APKs that are signed by v1 signature only. This is by design of the v1 JAR signature and can not be changed. But as the APK si also signed by v2 the warnings are irrelevant, see my answer here android.stackexchange.com/a/230709/2241
    – Robert
    Nov 24 at 15:55

1 Answer 1

30

The signature of the APK guarantees that if a file is changed in the APK after it is signed, it can't be installed on an Android device (the signature would be invalidated).

The signature of the APK is stored in the META-INF directory of the APK, which means that if some other files are stored in the META-INF directory, they are not covered by the signature. The warning you see shows you some files in your APK that are in the META-INF directory not protected by the signature.

In practice, these files are not important, they're mostly versions of libraries you depend on (only the version number, not the actual code of those libraries which is already compiled in the dex code), so even if someone modified those, it wouldn't have any impact on your app. That's why it's only a warning: those files in your APK can be modified by someone else while still pretending that the APK is signed by you, but those files don't really matter.

This is quite a common thing within APKs, so I wouldn't worry about it.

8
  • Thanks for your response and sharing the information, this should help... :)
    – Sec Occ
    Sep 2, 2018 at 20:04
  • @Pierre Isn't it a security concern if someone would manipulate the networking library and read all request & response data and forward sensitive data to their own server?
    – Peter F
    Jul 5, 2019 at 12:00
  • The executed files (dex and native libraries) are not under META-INF, so they are correctly covered by the signature so they can't be modified without invalidating also the signature.
    – Pierre
    Jul 5, 2019 at 14:41
  • 3
    I strongly disagree with 'In practice, these files are not important, they're mostly versions of libraries you depend on, so even if someone modified those, it wouldn't have any impact on your app.' An attacker can roll back your dependencies to previous vulnerable versions and then attack the vulnerabilities in these versions. This is indeed a security issue.
    – D.O.
    Mar 24, 2020 at 12:40
  • 8
    @D.O. That's not how it works... Changing the number of the version in a text file does not change the actual compiled code (the dependencies are already compiled in the rest of the APK, not pulled later on).
    – Pierre
    Mar 24, 2020 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.