4 ms·

> The JAR signature scheme only takes into account the zip entries. It ignores any extra bytes when computing or verifying the application's signature. Why? is

by junke 9y ago

> The JAR signature scheme only takes into account the zip entries. It ignores any extra bytes when computing or verifying the application's signature. Why? is there a use-case for this?

freeone3000 9y ago
Because that's how `jarsigner` (the Java application) signs. The code signature was fixed in Android 7.0.
- 0xtk 9y ago
  Does it mean the vuln only affects devices running < 7.0?
  - klyubin 9y ago
    The vuln affects all APKs on 5.0 <= Android < 7.0, and APKs not signed with APK Signature Scheme v2 on Android 7.0 and newer.
kuschku 9y ago
Jarsigner is designed to be used by Java. And both Jarsigner, and the Java command used to actually run the code on Oracle Java and OpenJDK use the same code – so they both only see the zip entries. This issue only exists because Android reused a signing process designed for an entirely different execution environment.