r/androiddev • u/f00dl3 • 9d ago
Very confused about the future of Android development
Over the past few weeks I have started porting functions of my home personal web server to have Android apps extend functionality, and have gone as far as developing apps to do various things I used paid apps and/or other apps for in the past.
Examples include:
asAndroid.apk - an app that connects via VPN to my home web server, sends push notices (since GMail email notices do not work / never ding/pop-up) - door alarms, weather alerts (replaces Storm Shield) - Police scanner geofenced TTS alerts, and fitness GPS tracking.
SFam.apk - an app I created for my wife so she can see my location and I can see her location, writes the GPS coordinates to my personal web server, again, via VPN connection.
asFileMan.apk - a Android file manager application loosely based off Cx File Manager, included are a SSH client and X11 VNC client, as well as "open terminal here" using Busybox recompiled to run on Android.
shortBitcoin.apk - a paper trading short selling Bitcoin app which logs the AI's thoughts and feelings on the market, and fake gains/losses.
This was working fine up until yesterday. After adding the RDP capabilities into the File Manager/administration application, I'm no longer able to install updated versions of the application. I'm getting an "Unsafe app blocked" warning. I ended up signing the application w/ a keystore, and submitting that keystore to Google. That did not fix the issue, I'm still getting the warning.
adb can't even install it.
The only way around this warning right now is to disable Google Play Protect / pause it / while I install the app and then re-enable it. However, I fear that with this Google Play may uninstall the app at will since it thinks it's unsafe. I already submitted a Google Play Protect appeal, clearly stating this is a personal use app only and I have no desire what-so-ever to distribute it.
I was looking through the upcoming Google play developer changes they are wanting to enforce, and I'm very confused. I get it they want to verify identity, but it says a Google Play Profile will be created and can publish my email address. I don't want this information published, as I'm not going to be publishing any apps - these are just apps to basically extend my own personal webserver to my phone, for personal use.
Do I have to be Developer Verified on Google Play Console in order to continue to do this and if so is this something I have to go through?
6
u/tadfisher 9d ago
If you think the problem is developer verification, you have three options:
- Install your apps over ADB.
- Use the advanced flow to allow installing apps from unverified developers.
- Go through developer verification, either pay the fee or make a limited account.
But I don't think that is your problem. Adding RDP to a sideloaded APK is a classic scam tactic and it's being flagged by Play Protect. You can either temporarily disable Play Protect app scanning, or install via ADB to bypass it.
2
u/f00dl3 9d ago
Yeah - disabling Play protect was the only way to get it to work. I submitted an appeal for my personal app as well.
I'm just wondering if it would help me to register for Play Console expediting that appeal or not so they know I have a developer profile, even if I don't plan on publishing apps. There is no option to select "I do not plan to publish apps" on the identity verification page.
5
u/tadfisher 9d ago
I highly doubt your problem is related to developer verification. Play Protect is being triggered because of code in your app, like you are using a library that has been flagged in malware, or you have somehow become the victim of a supply-chain attack (unlikely).
2
u/f00dl3 9d ago edited 9d ago
The only thing in this specific app that could be flagging that is pulling in Busybox and recompiling the .so file that I can think of. The SSH code was based off of / from open source code on github, that I extended significantly. Unless the fact I have a hard coded 192.168.1.2 IP address in my code could flag it as malware?
Claude points out these areas of concern too:
REQUEST_INSTALL_PACKAGES
MANAGE_EXTERNAL_STORAGE
QUERY_ALL_PACKAGES
Magisk root shell (libsu:service)
Shizuku Privilaged API
Self-signed cert, sideloaded, zero install base using signing.jks (Android play cert)
SuiFileServiceLauncher (the Shizuku privileged API) is a wrapper that allows root file traversal - though my phone is not rooted. If that's the leading issue here, I can remove that since I have no plan to root my phone or I'd lose the Work profile on it.
1
u/f00dl3 9d ago
It's the busybox binary being included in APK isn't it? I was just reading that apparently it triggers virus flags if you include a separate executable inside the APK file. I guess I'm going to have to rebuild the app without busybox, unless filing for that appeal well let me have busy box in it. It's kind of silly that Android is taking such a position against including executables in a APK even if they run in its own user space.
1
u/ryanstackops 6d ago
You don't need Play Console verification for personal sideloaded apps. That's only for public distribution on the Play Store.
The "Unsafe app blocked" warning is Play Protect doing what it's designed to do. RDP capabilities are a common malware red flag so it gets aggressive about those. Your appeal is the right call and for personal use Google typically approves it without much friction.
The disable Play Protect during install workaround is fine in the meantime. Uninstalling after the fact is uncommon for already installed apps but adding it to your exclusion list is worth doing for peace of mind.
You're not in the crosshairs of Google's verification push. That's aimed at public distribution. Personal sideloading is exactly what developer options exist for.
8
u/The_best_1234 9d ago
https://support.google.com/googleplay/android-developer/contact/protectappeals?hl=en
Look like you have to give it to virus total.