Nullcon Goa 2023 | Android-SigMorph: Covert Communication Exploiting Android Signing Schemes

This talk explores the intricacies of Android binaries, focusing on Signature Schemes (v1, v2, v3) used in Android APKs and the potential misuse of their vulnerabilities. The speaker demonstrates how to modify an Android APK binary without invalidating its signature, highlighting both malicious and non-malicious use cases. A significant point of discussion includes how malicious data can evade detection by antivirus systems when embedded in legitimate applications downloaded from the Play Store, all while maintaining the signing signature. The session also examines techniques for creating variations of malware, citing the Pegasus malware as a key example.