In some countries, the game isn't launched officially yet, but this is getting vastly popular as people are downloading from links containing APK files. I suspect that it is possible that the file contains malwares. How to check for it? What permissions that the app asks should I suspect?
Asked
Active
Viewed 622 times
6
-
4if it is not from the official store, then it is suspect – schroeder Jul 13 '16 at 20:12
-
9FYI: An app with no permissions requirements can still contain malware. – Alexander O'Mara Jul 13 '16 at 20:20
-
verify signature? – noɥʇʎԀʎzɐɹƆ Jul 13 '16 at 21:18
-
@JamesLu How? Maybe we could give OP a step-to step description of how to do this. – Fiksdal Jul 13 '16 at 21:26
-
@Fiksdal just a wild guess from a theoretical standpoint – noɥʇʎԀʎzɐɹƆ Jul 13 '16 at 21:27
-
@JamesLu Yes, it makes sense. Android actually does something like that with Google Play for sideloaded apps. It's connected to updates. But I don't understand fully how it works. – Fiksdal Jul 13 '16 at 21:31
2 Answers
9
As Alexander pointed out in the comments, checking permissions alone is not a reliable way to determine whether an APK is trustworthy or not. Especially not for an app like Pokémon Go, which is going to require a wide array of permissions in any case.
If you are forced to download an app from an unofficial source, one of the smartest things to do is to get it from a trusted source. The best thing would be if you had a real-world friend or family member with a Google Play account linked to a country where the app is released. That person could install the app from Google Play, copy the APK from their phone, and send it to you. This way you know you have a real, untampered APK, just like the original developers distributed it. Obviously, it is not often that you have such a friend, so on to the next option.
Apkmirror.com is run by the same people behind AndroidPolice.com, one of the biggest Android news websites. All uploads are manually vetted and approved, and only free apps are allowed so you won't find any 'cracked' APK or 'warez'.
As you already have the Play Store installed, only an APK signed with the same key as the currently installed version will be able to upgrade the app so this is an extra verification of the APK you download. Therefore, if you download the app from Apkmirror.com you should be safe.
APKmirror use both MD5 and SHA1 and they have gradually built up a solid reputation over years. I'm not aware of any confirmed case of a compromised APK on their site. Of course, it may plausibly still happen, but even the Play Store is not completely safe from all malware. APKmirror manually checks each APK.
Attribution for part of the section on apkmirror.com.
-
1APKMirror in addition offer an MD5 checksum for the download. Grab an MD5 checker from Google Play and point it at the freshly downloaded file. The hash on the website and the one produced by the MD5 checker should match. Of course, you are still trusting that the APKMirror site has not been compromised. – Jul 14 '16 at 07:48
-
1MD5 is no longe secure - researchers have made a fast program that replicates an MD5 hash given as input some data the collision should start with. -1 – noɥʇʎԀʎzɐɹƆ Jul 14 '16 at 20:51
-
@JamesLu Thanks for pointing that out. I've removed the part about MD5 from the answer. – Fiksdal Jul 14 '16 at 21:01
-
1@Fiksdal you still can't trust APKmirror if you have no secure signature – noɥʇʎԀʎzɐɹƆ Jul 14 '16 at 21:08
-
When you get an apk from someone else how do you know it doesn't install a trojan together with the game and they didn't notice? – Philipp Jul 14 '16 at 21:12
-
@JamesLu APKmirror also uses SHA1 and they have gradually built up a solid reputation over years. I'm not aware of any confirmed case of a compromised APK on their site. Of course, it may happen, but even the Play Store is not completely safe from malware. APKmirror manually checks each APK. – Fiksdal Jul 14 '16 at 21:13
-
@Philipp Because the other person would have gotten it directly from the Play Store. – Fiksdal Jul 14 '16 at 21:15
-
@Fiksdal please mention that then. this is information security, not superuser – noɥʇʎԀʎzɐɹƆ Jul 14 '16 at 21:20
-
@JamesLu Sure, I've added it to OP. Thanks for the feedback. SE is all about collaboration. – Fiksdal Jul 14 '16 at 21:25
-
you have my upvote now :) side note: although SHA1 is not secure theoretically and shouldn't be used, no one has done such attack I described in the previous comment on SHA1 – noɥʇʎԀʎzɐɹƆ Jul 14 '16 at 21:32
-
@Fiksdal new SHA1 certs on the web are already not allowed, and they are to be 100% banned (any site using a SHA1 cert will be blocked by modern browsers) in 2017 (maybe earlier) – noɥʇʎԀʎzɐɹƆ Jul 14 '16 at 21:50
-
-
-
@uoɥʇʎPʎzɐɹC Oh, ok :) For a moment I thought it might have been something like this. – Fiksdal Jul 14 '16 at 22:05
-
@Fiksdal it used to be just CrazyPython, but considering my generated image, I decided to add some flavor to it. – noɥʇʎԀʎzɐɹƆ Jul 14 '16 at 22:07
-
-
1
TheHackerNews reported this to be true here.
Security firm Proofpoint has discovered the malicious app, or APK, that has been infected with DroidJack – a Remote Access Tool (RAT) that can hack any Android device by opening a silent backdoor for hackers.
And they also talked about Pokemon GO granting itself full access to your google account here.
Adam Reeve labeled the game "malware," saying that Pokémon GO is a "huge security risk" as the game, for some reason, grants itself "full account access" to your Google account when you sign into the app via Google on iPhone or iPad.
With that in mind, i would follow Fiksdal's tips to be on the safe side.
kung
- 1,469
- 2
- 9
- 9
-
2The Google full access thing has been fixed now - v1.01 for iOS doesn't ask for full permissions. – Jul 14 '16 at 07:50
-
@Fiksdal Yes you are right, the game are distributed via third parties who inject malicious code into the game, but since the game only released in so few countries, a lot of people reside to download the game through these third parties. And the question also said "In some countries, the game isn't launched officially yet". – kung Jul 14 '16 at 08:00
-
@Fiksdal , I was looking at file permissions of Pokemon Go in one of my friend's phone. There was one permission which was : "Write/Delete to USB storage". Isn't it suspicious? – one Jul 14 '16 at 11:17
-
@one Where did your friend download Pokémon Go from? Where did he/she download it? I have installed it from APKmirror, and on my phone it needs to "read/modify/delete the contents of your SD card". Is that what you're talking about? Looking at Pokémon Go at Google Play, I can see that the official APK also needs access to device storage. – Fiksdal Jul 14 '16 at 11:42
-
1@Fiksdal yes, it was an apkmirror link. I checked and as also as you mentioned that official APK also needs access to device storage, it is settled. – one Jul 16 '16 at 16:47