CVE-2017-13156-Janus

CVE-2017-13156-Janus Reproduction

Attackers can use the Janus vulnerability (CVE-2017-13156) to bypass Android's signature scheme V1 mechanism, arbitrarily modifying application code without affecting its signature. Android's signature mechanism is used to protect applications from tampering. Normally, if an application is modified, it needs to be re-signed, otherwise it cannot be installed on the device. During installation, the system verifies the APK signature. If the signature does not exist or verification fails, the system rejects installation. Since attackers do not have the developer's private key, they use a different private key to re-sign the application, causing signature inconsistency. Signature verification can help detect whether an application has been tampered with to some extent. However, the Janus vulnerability allows attackers to tamper with an application without affecting its signature, enabling repackaged apps to overwrite official ones, posing a certain level of risk.

Copyright ©️ [Author Name]. For commercial reprints, please contact the author for authorization. For non-commercial reprints, please indicate the source.

Affected versions: Android 5.0-8.0

.
|____a.dex modified dex
|____target.apk modified apk
|____app
|____janus.py modification script
|____Janus.jar modified jar
|____cla.dex modified dex
|____README.md 
|____a.apk
|____f.apk
|____app-release.apk original apk

jar:

java -jar Janus.jar Janus [dex_file] [apk_file] [output_file]
java -jar Janus.jar Janus a.dex app-release.apk a.apk

python:

python janus.py [dex_file] [apk_file] [output_file]
> python janus.py a.dex app-release.apk a.apk

Steps attempted:

1. Generate the original APK
2. Decompile smali with baksmali, modify strings
3. Recompile smali into dex
4. Use PoC to generate new APK
5. Add Toast
6. Add more logs, compare logs
7. You can first modify the original Java, compile a new APK, then inject the new APK's dex to see the result
8. Insert a unique function in the modified dex; if hooked, it means it executed

Tested on Xiaomi phone (6.0.1) – not successful; installation succeeded but code did not execute Tested on Nexus phone (6.0.1) – not successful; installation succeeded but code did not execute Tested on Sony phone (4.4.3) – not successful; installation failed Speculation: the phone had the patch applied

Reproduction by others Python PoC Java PoC Janus signature vulnerability (CVE-2017-13156) principle and exploitation analysis Antiy Mobile Security: In-depth analysis of Janus high-risk vulnerability Janus vulnerability analysis