Worst that could happen if Obtanium was comprimised?

Ax788

Obtanium is pretty handy, but i was wondering whats the worst that could happen if it was compromised (either by the dev or a malicious 3ed party)

If I understand correctly, installed apps can't be replaced or updated with unofficial versions. But could a rogue Obtanium install new apps or malware unnoticed?

AcclaimSublevel19

Ax788 you get a popup asking whether you want to install an app. But you can't verify anything other than the name and icon, which can be easily replicated anyway. This goes for every appstore. The only secure option would be to install directly from the built-in appstore or at least from Files.

Existing apps cannot be updated to malicious versions without their signing keys.

DohnJoe

Ax788

I am not sure what kind of attack you are trying to assess.

If you are trying to assess a 3rd app that pretends to be Obtainium, as others said it will not be able to update any app.
For new installed app could potentially succed if you interact with the prompt.

If you are trying to assess an attack to the "supply chain" (in other words, they could push a rogue Obtainium update in their official repository), I would say that apart from a notice from the dev, this kind of attack could update apps if they are signed with the same key.
If you match this security feature with the impossibility to downgrade an app, this factively means that they wouldn't be able to install any arbitrary app without your consent.

This is basically the difference between an app installed through Obtainium (from their official repo) and an app installed through an f-droid client (from the main f-droid repo only).

Btw, with the "supply chain" attack they probably could uninstall something you installed with obtainium in the past, so the damage they can do is related to service/data availability, especially if the app doesn't sync with an external source.

Also, in a "supply chain" attack they wouldn't need to install any other app, because they already could push code into Obtainium itself.

While this is technically doable, it would require a lot of effort to succed, and apart from the very low gain an attacker would have, it must involve the Obtainium team/infrastructure to be weak and/or vulnerable.

As previously said by others, very unlikely.

Vincent96

It wouldn't be able to install new apps without user confirmation and existing apps it controls can't be updated with malicious code due to malicious updates being unsigned. It could theoretically use it's access to the filesystem to steal your files or use any other permissions you gave it against you. I don't think this is a realistic scenario.

Novalissoide

Vincent96 don't think this is a realistic scenario.

I agree. Obtainium don't really come across as a given pick for a hacking vehicle. In that it got few privilieges, and the way users employ it varies too much, but that's just my brief speculation, not a deep assessment.

Ax788

Thanks for the replies, its good to know