Detecting Malicious Repackaged Apps via Digital Signature Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face difficulties in distinguishing between legitimate and repackaged malicious applications, as repackaged applications often have similar functionality to the original, making it hard to detect and prevent the installation of malicious digitally-signed applications.
Innovation Solution
A system and method that identifies digitally-signed application package files by comparing them to known files, determining if they have been repackaged, and checking the digital signature public keys, performing a security action if the keys are different, such as classifying the application as potentially malicious or preventing installation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If repackaged applications are distributed with the same functionality as original applications, then users cannot easily distinguish between legitimate and malicious applications, but this makes malware detection difficult
Solution Approach 1:
The patent introduces digital signatures and public key comparison as an intermediary mechanism to detect repackaged applications. Instead of relying on users to visually distinguish applications, the system uses cryptographic signatures as a mediator that automatically reveals whether an application has been repackaged, solving the detection difficulty without affecting application functionality
Solution Approach 2:
The patent applies the principle of making invisible differences visible by using digital signature verification. Just as color changes make invisible properties visible, the digital signature mechanism makes the invisible difference between original and repackaged applications detectable through public key comparison, allowing users to identify malicious applications despite functional similarities
2Reliability
If digital signature verification is performed to detect repackaged applications, then malicious applications can be identified, but this increases system complexity
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing public keys of known legitimate applications in a database before distribution. When an application is installed or executed, the system retrieves the stored public key and compares it with the signature's public key, eliminating the need for complex real-time cryptographic operations and reducing system complexity while maintaining high reliability
Solution Approach 2:
The patent uses copying by storing pre-computed public keys of legitimate applications in a database. Instead of performing complex verification operations on each application, the system copies the relevant verification data (public keys) ahead of time and uses simple comparison operations, reducing computational complexity while maintaining detection reliability
Data Source
AI summary
A computer-implemented method for detecting malicious digitally-signed applications. The method may include 1) identifying an application package file that has been digitally signed, wherein the application package file is used to distribute an application, 2) comparing the application package file to a set of known application package files, 3) determining that the application package file has been repackaged from a known application package file, 4) comparing a public key associated with a digital signature of the application package file to a public key associated with a digital signature of the known application package file, 5) determining that the public key associated with the digital signature of the application package file and the public key associated with the digital signature of the known application package file are different, and 6) performing a security action on the application. Various other methods, systems, and computer-readable media are also disclosed.