Signing certificate mismatch · Android · react-native-device-integrity

At a glance

Platform: Android
Category: App tamper
Source: TamperChecks.kt · checkSignatureMismatch
Default status: Makes status compromised
Seen firing: Seen firing in S05, S07, S10. Based on validated scenarios whose observed result includes this signal; see below.
OWASP MASTG: MASTG-TEST-0038

How it works

What the code inspects.

Reads the app's signing certificates via PackageManager (GET_SIGNING_CERTIFICATES on API 28+, honoring v3 key rotation via the signing history; GET_SIGNATURES on older APIs), SHA-256-hashes each, and checks whether any matches a digest in your expectedSigningCertificates.

A configured-but-empty/blank digest list throws, marking the run incomplete (→ unknown) rather than passing silently. No match → tamper_signature_mismatch.

The exploit it addresses

Why this matters.The threat.

Repackaging an app — adding ads/malware, patching out checks, cloning for phishing — requires decoding and rebuilding the APK (e.g. with Apktool), which strips the original signature. The attacker must re-sign with their own key, changing the certificate hash. Pinning your real certificate catches every such repackaged build.

How it can be bypassed

No single check is sufficient.Known evasions.

An attacker who roots the device can hook PackageManager.getPackageInfo to return your genuine certificate bytes while the running code is modified — the check trusts the OS's answer.

This is client-side: only server-side Play Integrity (which reports the signing certificate to Google's backend) proves the signature to your server.

Validation scenarios