Post #3485358
2026-06-29 23:10 UTC
SnakeOil !!11!!
I've just taken the unsigned APK, renamed it to test17.zip, removed the META-INF/ directory, AndroidManifest.xml, and kotlin-tooling-metadata.json files (all text files only) so it's no longer recognizable as APK – and guess what?
ALL engines show green. No findings.
So: was the malware in those text files? Or is it just "safe" because it does not need to be on Play? If it were signatures matching, they should still have matched. My guess: AndroidManifest.xml.
Replies (2)
-
@IzzyOnDroid@floss.social 2026-06-29 23:16
Bingo. Same file, just not deleting the AndroidManifest.xml – and all the red ones chime in again. Next try: only delete the AndroidManifest.xml. Wanna make your bets? I win! All green again. There you have it: if it's an Android app, it's baaad if it's not on Play (if it requests SMS+Internet permissions). And it's no signature match at all – only the AndroidManifest.xml with the permission list in.
-
@gim@lou.lt 2026-06-30 04:08
@IzzyOnDroid@floss.social (re: test17.zip) if it's not APK, how do you want to deploy it on an actual phone?