Exploit for Android signing hole published

Android exploit

An exploit for the Android code signing hole, which was revealed a few days ago by Bluebox in advance of a presentation at the BlackHat conference, has now been published on GitHub. It allows its user to manipulate the files within APK format packages without the operating system being able to detect that the APK package has tampered with.

A package's manifest file has a hash for each file, but by saving both the modified and original file in the APK package, the checking of that hash can be fooled. The system checks the latter, original, file and passes it as valid but when it installs the package it installs the former, modified version of the file.

Exploit for Android signing hole published | The H Security