Apa Itu APK Android? Struktur, Signature & Checklist Keamanan
Pelajari struktur APK, cara verifikasi signature, deteksi malware, dan 12 security checklist dari expert bersertifikat. Lindungi device Anda dengan pengetahuan mendalam tentang Android Package Kit.
Apa Itu APK (Android Package Kit)?
APK (Android Package Kit) adalah format file package yang digunakan oleh sistem operasi Android untuk distribusi dan instalasi aplikasi mobile. File APK berisi semua elemen yang diperlukan untuk menjalankan aplikasi Android, termasuk code, resources, assets, certificates, dan manifest file.
Format APK didasarkan pada Java Archive (JAR) format dan menggunakan ZIP compression. Setiap file APK harus di-sign secara digital dengan certificate sebelum dapat diinstall pada Android device, memastikan authenticity dan integrity dari aplikasi.
Fun Fact: Sejak Android 9 (Pie), Google memperkenalkan Android App Bundle (AAB) sebagai format publishing modern, namun APK tetap menjadi format instalasi aktual di device. Google Play Store secara otomatis generate optimized APK dari AAB untuk setiap device configuration.
Struktur File APK
🗂️ Komponen Utama APK
| Komponen | Deskripsi | Mandatory |
|---|---|---|
| AndroidManifest.xml | Manifest file berisi metadata aplikasi: package name, permissions, components (activities, services, broadcast receivers), minimum SDK version, dll | ✅ Ya |
| classes.dex | Dalvik Executable bytecode hasil compile dari Java/Kotlin source code. Berisi application logic dan class files | ✅ Ya |
| resources.arsc | Compiled resources table berisi string values, layouts, dimensions, colors, dll dalam format binary | ✅ Ya |
| META-INF/ | Directory berisi certificate signature (CERT.RSA/DSA/EC), manifest file (MANIFEST.MF), dan signature file (CERT.SF) | ✅ Ya |
| res/ | Directory resources seperti layouts (XML), drawables (images), values (strings, colors), raw files, dll | ⚠️ Optional |
| assets/ | Raw asset files seperti database, fonts, videos yang dapat diakses menggunakan AssetManager API | ⚠️ Optional |
| lib/ | Native libraries (.so files) compiled untuk architecture tertentu (arm64-v8a, armeabi-v7a, x86, x86_64) | ⚠️ Optional |
| kotlin/ | Kotlin-specific metadata untuk Kotlin applications | ⚠️ Optional |
example.apk
├── AndroidManifest.xml
├── classes.dex
├── classes2.dex (jika multidex enabled)
├── resources.arsc
├── META-INF/
│ ├── CERT.RSA (signature certificate)
│ ├── CERT.SF (signature file)
│ └── MANIFEST.MF (manifest entries)
├── res/
│ ├── layout/
│ ├── drawable/
│ ├── values/
│ └── ...
├── assets/
│ └── (custom files)
└── lib/
├── arm64-v8a/
│ └── libnative.so
├── armeabi-v7a/
│ └── libnative.so
└── x86_64/
└── libnative.so
APK Signing & Verification
APK Signature Scheme v1 (JAR)
Legacy signing scheme berbasis JAR signature. Menggunakan MANIFEST.MF, CERT.SF, dan CERT.RSA dalam META-INF/. Vulnerable terhadap Janus vulnerability (CVE-2017-13156). Tidak recommended untuk aplikasi baru.
APK Signature Scheme v2
Introduced Android 7.0 (Nougat). Faster verification dengan sign seluruh APK (bukan per-file). Protected dari modification dengan APK Signing Block. Recommended minimum standard.
APK Signature Scheme v3
Android 9.0 (Pie)+. Support key rotation untuk update signing certificate tanpa break compatibility. Lineage proof-of-rotation untuk trusted update path. Best practice untuk aplikasi modern.
APK Signature Scheme v4
Android 11+. Stream-friendly signature untuk mendukung ADB incremental installation. Signature stored di separate .apk.idsig file. Optimized untuk large apps dan faster installation.
12 Security Checklist Sebelum Install APK
10 Ancaman Umum pada APK
Trojan Banking
Malware yang mencuri kredensial banking dengan overlay attack atau keylogging. Contoh: Anubis, Cerberus, Medusa. Target: mobile banking apps dengan fake login screens.
SMS Fraud
Trojan yang subscribe premium SMS services atau forward SMS (termasuk OTP) ke attacker. Contoh: Joker, Hummer. Silent subscription = tagihan bulanan membengkak.
Spyware
Surveillance malware yang record calls, capture screenshots, track location, dan exfiltrate data. Contoh: Pegasus (nation-state), commercial stalkerware. Privacy nightmare.
Adware Aggressive
Display intrusive ads (fullscreen, auto-open browser, fake notifications). Monetize via ad fraud. Contoh: HiddenAds family. Drain battery, annoying UX, privacy concerns.
Ransomware Mobile
Encrypt files atau lock device, demand ransom payment. Contoh: DoubleLocker, Svpeng. Rare tapi devastating. Backup data = essential defense.
Botnet Client
Join device ke botnet untuk DDoS attack, crypto mining, atau spam distribution. Contoh: HummingBad, DressCode. Device jadi zombie, drain battery & data.
Credential Phishing
Fake apps mimicking popular services (Netflix, banking) untuk harvest credentials. Sophisticated UI clone. Always verify package name & developer.
Call & SMS Intercept
Malware dengan Accessibility Service abuse untuk intercept calls/SMS. Bypass 2FA dengan OTP theft. Restricted di Android 13+ tapi masih prevalent.
Crypto Miner
Background cryptocurrency mining (Monero, Bitcoin) menggunakan device resources. Extreme battery drain, overheating, reduced lifespan. Not worth the profit for attacker.
Dropper / Downloader
Stage-1 malware yang download & execute second-stage payload. Bypass Play Store scanning. Delay malicious activity = evade detection. Multi-stage attack.
Tools untuk APK Analysis
🛠️ Essential Security Tools
| Tool | Purpose | Platform |
|---|---|---|
| apksigner | Verify APK signature, check signing certificate, validate v1/v2/v3/v4 schemes | Android SDK |
| aapt/aapt2 | Dump APK info: permissions, package name, version, resources, configurations | Android SDK |
| APK Analyzer | Visual inspection APK structure, DEX files, resources, compare APK sizes | Android Studio |
| jadx / jadx-gui | Decompile DEX to Java source code untuk static analysis. Best decompiler available | Cross-platform |
| Apktool | Reverse engineering: decode resources to original form, rebuild APK after modifications | Cross-platform |
| MobSF | Mobile Security Framework: automated static & dynamic analysis, vulnerability scanning | Web-based |
| VirusTotal | Scan APK dengan 70+ antivirus engines, behavioral analysis, community reports | Web API |
| Ghidra | Reverse engineering native libraries (.so), disassemble ARM/x86 code, advanced analysis | NSA tool |
| Frida | Dynamic instrumentation: hook functions, intercept API calls, modify runtime behavior | Cross-platform |
| Objection | Frida-based runtime mobile exploration: bypass SSL pinning, dump memory, explore sandbox | CLI tool |
Siap Download APK Aman & Terverifikasi?
Semua APK di platform kami telah melalui 12 security checks, scan 70+ antivirus engines, dan verified signature. Download dengan confidence!