Detect if an app is installed from Play store

Question

I want to check and allow the use of my app just if it has been downloaded from the Play store, and it has not been shared by other user or from any other source. How can I prevent an user to use the app if it has not been downloaded from the Google Play store?

Answer 1

This method will check if your app has been installed from the Play Store.

boolean verifyInstallerId(Context context) {     // A list with valid installers package name     List<String> validInstallers = new ArrayList<>(Arrays.asList("com.android.vending", "com.google.android.feedback"));      // The package name of the app that has installed your app     final String installer = context.getPackageManager().getInstallerPackageName(context.getPackageName());      // true if your app has been downloaded from Play Store      return installer != null && validInstallers.contains(installer); } 

Some days ago I released an Android library, PiracyChecker, that protects your app using some techniques, such as Google Play Licensing (LVL), APK signature protection and installer ID (this one).

Answer 2

Bypass the Check

I want to check and allow the use of my app just if it has been downloaded from the Play store, and it has not been shared by other user or from any other source.

While this check is possible to achieve programmatically its also possible to bypass by repackaging the app without the check or by using an instrumentation framework at runtime to bypass the check. An example of such a framework is Frida:

Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts.

I wrote an article to show how to use Frida to bypass certificate pinning in an Android app, and the same approach can be used to bypass this check. The only difference is that you need to find the correct Frida script or write yourself one and use it in place of the on to bypass pinning. The Frida Code Share website as a huge set of scripts and one may exist for this propose or can be used as a starting point to see how to write your own script.

Protect the Check

How can I prevent an user to use the app if it has not been downloaded from the Google Play store?

So, if you use the built-in context.getPackageManager().getInstallerPackageName(context.getPackageName()); or any other method you will be safeguarded against normal users that do not install your mobile app from the Google play store, but anyone wanting to attack your mobile app will have several ways of bypassing this protection as I mention above.

A possible to solution to protect your mobile app against attackers bypassing your check is to use Runtime Self Defense Protections or a Mobile App Attestion solution, and I recommend you to read this answer, especially the sections Hardening and Shielding the Mobile App, Securing the API Server and A Possible Better Solution to see how you can prevent your mobile app to work properly when its not your genuine mobile app.

Do You Want To Go The Extra Mile?

In any response to a security question I always like to reference the excellent work from the OWASP foundation.

For Mobile Apps

OWASP Mobile Security Project - Top 10 risks

The OWASP Mobile Security Project is a centralized resource intended to give developers and security teams the resources they need to build and maintain secure mobile applications. Through the project, our goal is to classify mobile security risks and provide developmental controls to reduce their impact or likelihood of exploitation.

OWASP - Mobile Security Testing Guide:

The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security development, testing and reverse engineering.