search

onaio / steps-app

WHO STEPS App
Apache License 2.0
2 stars 2 forks source link

Rebuild the APK and sign with v2 and/or v3 #201

Closed bkimondiu closed 2 years ago

bkimondiu commented 2 years ago

This will help resolve the following:

  1. Application vulnerable to Janus Vulnerability - Application is signed with v1 signature scheme, making it vulnerable to Janus vulnerability on Android 5.0-8.0, if signed only with v1 signature scheme. Applications running on Android 5.0-7.0 signed with v1, and v2/v3 scheme might also be vulnerable.
  2. Certificate algorithm might be vulnerable to hash collision - Application is signed with SHA1withRSA. SHA1 hash algorithm is known to have collision issues. The manifest file indicates SHA256withRSA is in use.
owais-vd commented 2 years ago

we are using minSdkVersion 21 lollipop and I think we can switch the signature scheme while building a release APK. However, this link https://jokester.github.io/posts/2017-02-28/sha1-collision-and-apk-signing/ can help to get more context. cc: @bkimondiu @ekigamba

ndegwamartin commented 2 years ago

We'll need to sign with V1 as well for versions below Android 7 . See SO post here and Android documentation here for maximum compatibility