You Shall not Repackage! Demystifying Anti-Repackaging on Android
Alessio Merlo, Antonio Ruggia, Luigi Sciolla, Luca Verderame

TL;DR
This paper critically examines current anti-repackaging techniques for Android apps, revealing their vulnerabilities and demonstrating how attackers can bypass these protections, including a full attack on the only publicly available tool, NRP.
Contribution
It analyzes weaknesses of existing anti-repackaging schemes, summarizes attack vectors, and demonstrates how these can be exploited to bypass protections, including a practical attack on NRP.
Findings
Current anti-repackaging schemes have significant vulnerabilities.
Attack vectors can effectively bypass existing protections.
A full attack on the NRP tool demonstrates practical bypass feasibility.
Abstract
App repackaging refers to the practice of customizing an existing mobile app and redistributing it in the wild. In this way, the attacker aims to force some mobile users to install the repackaged(likely malicious) app instead of the original one. This phenomenon strongly affects Android, where apps are available on public stores, and the only requirement for an app to execute properly is to be digitally signed. Anti-repackaging techniques try counteracting this attack by adding logical controls in the app at compile-time. Such controls activate in case of repackaging and lead the repackaged app to fail at runtime. On the other side, the attacker must detect and bypass the controls to repackage safely. The high-availability of working repackaged apps in the Android ecosystem suggests that the attacker's side is winning. In this respect, this paper aims to bring out the main issues of the…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
