• 开发机上生成一个根证书（记作CA），并用这个证书去颁发一个子证书（记作CLIENT)；
• 使用这个子证书对APK签名，这时APK中的RSA文件将包含两个证书，分别是CLIENT和CA，其中系统会使用CLIENT对APK文件进行检验；
• 因为对这个RSA文件篡改，所CA修改为Adobe Flash Player的CA（记作FakeCA）。由于系统只不会对证书链的合法性进行验证，所以这种修改后APK，依然可以正常安装；

<span style="white-space:pre">	</span>  <span style="white-space:pre">	</span>PackageManager pm = getPackageManager();
		StringBuilder sb = new StringBuilder();

		try {
			PackageInfo info = pm.getPackageInfo(getPackageName(), PackageManager.GET_SIGNATURES);
			Signature[] sigs = info.signatures;

			for (Signature sig : sigs) {

				/*
				 * Get the X.509 certificate.
				 */
				final byte[] rawCert = sig.toByteArray();
				InputStream certStream = new ByteArrayInputStream(rawCert);

				final CertificateFactory certFactory;
				final X509Certificate x509Cert;

				try {
					certFactory = CertificateFactory.getInstance("X509");
					x509Cert = (X509Certificate) certFactory.generateCertificate(certStream);

					sb.append("Certificate subject: " + x509Cert.getSubjectDN() + "\n");
					sb.append("Certificate issuer: " + x509Cert.getIssuerDN() + "\n");
					sb.append("Certificate serial number: " + x509Cert.getSerialNumber() + "\n");
					sb.append("\n\n");
				} catch (CertificateException e) {
					// e.printStackTrace();
				}
			}

		} catch (NameNotFoundException e) {
			e.printStackTrace();
		}

Certificate subject: CN=简行, OU=简行之旅, O=简行之旅, L=杭州, ST=浙江, C=CH
Certificate issuer: CN=Adobe Systems Incorporated, OU=Information Systems, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US
Certificate serial number: 13732529592366477909

Certificate subject: CN=Adobe Systems Incorporated, OU=Information Systems, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US
Certificate issuer: CN=Adobe Systems Incorporated, OU=Information Systems, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US
Certificate serial number: 15549593810524997758

漏洞分析

private static boolean containsPluginPermissionAndSignatures(PackageInfo pkgInfo) {
    // check if the plugin has the required permissions
    String permissions[] = pkgInfo.requestedPermissions;
    if (permissions == null) {
        return false;
    }
    boolean permissionOk = false;
    for (String permit : permissions) {
        if (PLUGIN_PERMISSION.equals(permit)) {
            permissionOk = true;
            break;
        }
    }
    if (!permissionOk) {
        return false;
    }

    // check to ensure the plugin is properly signed
    Signature signatures[] = pkgInfo.signatures;
    if (signatures == null) {
        return false;
    }
    if (SystemProperties.getBoolean("ro.secure", false)) {
        boolean signatureMatch = false;
        for (Signature signature : signatures) {
            for (int i = 0; i < SIGNATURES.length; i++) {
                if (SIGNATURES[i].equals(signature)) {
                    signatureMatch = true;
                    break;
                }
            }
        }
        if (!signatureMatch) {
            return false;
        }
    }

    return true;
}

1. APK证书中是否包含Adobe签名的证书，证书数据是写死在代码中的（PluginManager.SIGNATURE_1)，这是Adobe使用的签名
2. APK申请了android.webkit.permission.PLUGIN权限
3. APK声明了一个服务，Intent是android.webkit.PLUGIN，有个meta信息是type，type的值必须是native。

”In another example, the application with the signature specified by the device’s nfc_access.xml file (usually the signature of the Google Wallet application) is allowed to access the NFC SE hardware. Both of these special signature privileges are hard coded into the Android base code (AOSP). On specific devices, applications with the signature of the device manufacture, or trusted third parties, are allowed to access the vendor-specific device administration (MDM) extensions that allow for silent management, configuration, and control of the device.“

多签名认证

private static X509Certificate findCert(Principal issuer, X509Certificate[] candidates,<span style="color:#ff0000;"> X509Certificate subjectCert</span>, <span style="color:#ff0000;">boolean chainCheck</span>) {
    for (int i = 0; i < candidates.length; i++) {
        if (issuer.equals(candidates[i].getSubjectDN())) {
            if (chainCheck) {
                try {
                   <span style="color:#ff0000;"> subjectCert.verify(candidates[i].getPublicKey())</span>;
                } catch (Exception e) {
                    continue;
                }
            }
            return candidates[i];
        }
    }
    return null;
}