Bad Certificate Management in Google Play Store
Summary: A Unit 42 study of roughly 246,000 Android apps in the Google Play Store found they were signed by only 11,681 certificates, with about 6,925 certificates used across 6 to 19 different apps each. The researchers found at least 87 apps signed with the publicly known AOSP "testkey" (downloaded more than 1.6 million times), one certificate signing more than 300 mobile banking apps, and third-party developers reusing a single certificate across all apps built for all customers.
What's compelling: Android treats apps signed with the same certificate as one application, so anyone holding a leaked or publicly known private key can silently replace a legitimate app through the normal upgrade procedure - and the 87 testkey-signed apps alone account for more than 1.6 million downloads.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026