Android App Security · Inside an APK · Lesson 5 of 5

Challenge: The Free Premium Vault

Investigate a 'free premium' app your uncle found and decide if it's real.

The case brief

Your uncle uses PhotoVault, an app from Google Play that hides private photos behind a PIN. The premium version costs $4.99 a year. On a forum, he found a link to "PhotoVault Premium, unlocked, free". He downloaded the APK and asks you to look at it before he installs it.

You compare it with the copy installed from Play:

• Both use the package name com.photovault.app.
• Both certificates say "PhotoVault Inc".
• The Play copy's SHA-256 fingerprint starts 91:C4. The forum copy's starts 5E:02.
• The forum copy's versionCode is higher than the Play copy's.

Your uncle points at the matching names and says it must be the same company's app, just unlocked. He also mentions that the forum post has hundreds of thankful replies, and that the uploader promises it's "100% safe".

The failed install

Before you can stop him, your uncle taps the APK. His browser already had Install unknown apps turned on from last year. Android shows an error and the app doesn't install.

He's confused. The forum version has a higher versionCode, so he thought Android would treat it as an upgrade over the Play copy. The package name matches too, so as far as he can tell, the phone should see it as the same app. You explain that a version number only says which copy is newer, not who made it.

Reading the manifest

You decode the forum APK's manifest and compare it with the Play version. The forum copy requests everything the real app does, plus three extras:

• READ_SMS
• RECEIVE_BOOT_COMPLETED
• INTERNET (the real app works fully offline and never asks for it)

It also adds a new service that wasn't in the original. Your uncle shrugs and says every app asks for a long list of things these days. You want to show him which single line should worry him most.

The workaround

Your uncle reads online that he can uninstall the Play version first and then install the forum copy. He'd lose his hidden photos unless he exports them first, but he likes the idea of free premium.

He asks you what happens later, when PhotoVault Inc fixes a bug and releases a real update on Google Play. He assumes the Play Store will simply update whatever PhotoVault is on his phone, the way it always has.