Aurorastore 2 diff checksums in AppVerifier database?

Goswin

Can anyone please explain why Aurora Store downloaded from auroraoss.com (official site) and aurorastore.org both show "internal data base: success" for checksums on AppVerifier. Even though they show different checksums? (4C:.... Vs 5C:...)

Thanks in advance

other8026

Goswin maybe one of them is actually the F-Droid version? https://github.com/soupslurpr/AppVerifier/blob/v0.8.2/app/src/main/kotlin/dev/soupslurpr/appverifier/InternalVerificationInfoDatabase.kt#L785

Goswin

Makes sense. Seems to be the same as the fdroid version. Thank you for the quick reply.

other8026

Goswin no problem!

garph

aurorastore.org is a phishing site, don't download stuff from there!!!

See https://t.me/AuroraSupport/392133

Incredible that it's still around

Goswin

garph

Wow. Thanks for the reply.

Are you aware what the main security risks would be if downloaded from this source?

I'm now a bit confused as to what the point of something like AppVerifier is if it shows "SUCCESS" after downloading from this source.

soupslurpr

Goswin

AppVerifier is showing SUCCESS because the apk you downloaded from there is actually legit. Not that it's a good idea to get it from there as that could change in the future but the hash matches with Aurora Store's official website and GitLab: https://auroraoss.com/

soupslurpr

The one that starts with 5C indeed is the F-Droid version.

Goswin

soupslurpr

soupslurpr The one that starts with 5C indeed is the F-Droid version.

This is the version found on the phishing site

Goswin

Okay so just to be clear, there is currently no harm done downloading from there as the apk is currently legit?
But as no one knows who it is, that could become dangerous in future.
If accidentally downloaded, best security practice is to just delete it or would it require further cleaning such as a factory reset etc..?

soupslurpr

Goswin nothing will happen from just downloading it even if it was malicious, installing and using it though is different

soupslurpr

Goswin I'd probably delete that and get it from the official site, maybe use Obtainium to keep it up to date if it doesn't have a built-in updater

Goswin

soupslurpr

Sorry, I meant to say installing and using it.

soupslurpr

Goswin Okay, then just follow what I said above

Goswin

soupslurpr

Okay so the solution is the same either way.
There's no added benefit to factory resets etc..

Thanks again for your help

soupslurpr

Goswin the chance that the device got compromised is very very low, plus I checked that that site's apk was legit so I wouldn't do that

soupslurpr

But definitely be more careful in the future

Goswin

Okay. Thank you again.