Android app signing explained: v1, v2, v3 and the Janus vulnerability
Every Android app is signed to prove its origin — but the signature scheme matters. Here's v1 vs v2/v3, the Janus tampering attack, and how to check your app.
Last updated 2026-09-05
Read in context. These instructions need to be adapted to your app and platform version. New scans provide static detections; they do not establish current backend access. Current methodology.
What app signing does
The signature ties an app to a developer certificate. Android uses it to verify the app hasn't been tampered with and to ensure updates come from the same author (an update must be signed with the same key).
The signature schemes
- v1 (JAR signing): signs individual files inside the ZIP, but not the whole archive structure — leaving gaps an attacker can abuse.
- v2 (APK Signature Scheme): signs the entire APK as a block, closing those gaps. Introduced in Android 7.0.
- v3: builds on v2 and adds key rotation, so you can migrate to a new signing key over time.
The Janus vulnerability (CVE-2017-13156)
On apps signed with v1 only, an attacker can prepend a malicious DEX to the APK without breaking the JAR signature — older Android versions would run the injected code while the app still appeared validly signed. Signing with v2/v3 (which hash the whole file) defeats it.
Other weak-signing signals
- SHA-1 digest — a deprecated hash; use SHA-256 or stronger.
- Short RSA key — use RSA ≥ 2048 bits or an EC key.
- Expired certificate — renew before it lapses.
- Debug certificate — a release signed with the well-known Android debug key has no real provenance.
How to check and fix
apk-scanner.com provides static findings, build details and analysis coverage. Scans check whether a referenced backend answers an unauthenticated request, never using a detected credential and never reading stored data. Review the current methodology and each report’s limitations.
Frequently asked questions
Do I still need v1 signing?
Only to support Android versions older than 7.0. If your minSdk is 24+ you can drop v1 entirely and ship v2+v3, which also removes Janus exposure.
What exactly is the Janus vulnerability?
CVE-2017-13156 — on v1-only apps, a crafted DEX can be prepended to the APK without invalidating the JAR signature, so a tampered app still looks correctly signed to older Android. v2/v3 signing prevents it.
Is a debug-signed app dangerous?
A debug certificate is public knowledge, so it provides no real proof of who built the app and anyone can sign an update-looking package. Release builds should always use a private release key.