Android

Untrusted install sourceApp tamper

Checks which package installed the app against your allow-list (e.g. the Play Store). Opt-in.

tamper_untrusted_installerCompromising by default

At a glance

Platform: Android
Category: App tamper
Source: TamperChecks.kt · checkUntrustedInstaller
Default status: Makes status compromised
Seen firing: Seen firing in S05, S07. Based on validated scenarios whose observed result includes this signal; see below.
OWASP MASTG: MASTG-TEST-0038

How it works

What the code inspects.

Reads the installing package via PackageManager.getInstallSourceInfo (API 30+) / getInstallerPackageName (older), and checks it against your allowedInstallers (e.g. com.android.vending for Play, or your MDM).

A blank-only allow-list throws (→ unknown). An installer that is null, empty, or not in the list → tamper_untrusted_installer.

The exploit it addresses

Why this matters.The threat.

A legitimately distributed app is installed by a trusted store; a sideloaded APK (installed by a browser, a file manager, or adb) is a common delivery path for cracked, repackaged, or trojanized builds. The installer identity is a cheap signal of distribution channel.

How it can be bypassed

No single check is sufficient.Known evasions.

The installer attribution can be spoofed: an attacker can install the APK via a session that claims com.android.vending as the installer package.

Legitimate enterprise/MDM and alternative-store distribution produce non-Play installers, so this needs an allow-list tuned to your real channels to avoid false positives.

Validation scenarios

Where this check is exercised.4 scenarios.

S07

Untrusted installer

Validated · android

Open →S08

Misconfigured tamper options fail closed

Validated · android

Open →S09

Ignore specific signals

Validated · android

Open →D05

Play Store install passes the installer check

Pending · android

Open →

References & further reading

All checks

← Signing certificate mismatch iOS Simulator →