Can governments compell mobile app developers to push out targeted updates as a privilege escalation or pivot point on a "suspect's" device?

Android app dev here, i cant tell you what governments are capable of, but i can describe for you some of the complicating factors preventing them from doing this.

For one, to prevent impersonation, apps are cryptographically signed by the developer using a private key they never share with anyone (like a password), and the public key is sent to Google Play and the App Store so that they can verify the identity of the uploader. This prevents app store listings from being hijacked by rivals, competetors, hackers, pirates, foreign governments, and yes, their own government. So, any goverment cant just walk up and push a rogue update to the store.

For two, deploying app updates isn't my job, it's Google's and Apple's. In my opinion if the government wanted to hijack the supply chain, going directly to Apple or Google would be the way to do it. The narrowest group of people I can push updates to are the people who opted into alpha or beta versions. To target an individual, youd have to do it through Google or Apple.

For three,, my boss barely gives me enough time and resources to meet the company's own goals, let alone letting me clean up tech debt. The idea of a government that twists my boss's arm to force me to work for the government instead of the shareholders is kinda funny and nonsensical. I live in the USA, where shareholders are king. I bet that even if we went full toltalitarian this would never happen because of rich people backlash. So i dont think the hacking coming from inside a company would happen. Then again, i perhaps dont work for a juicy enough place to see how a government could solve this problem, *or maybe they would be stupid enough to incur the political expense anyway.

And last, money money money. Programmers are not cheap. Designing and dedicating and selecting targets for an attack isnt cheap. Hacking into a company to steal their private key isnt cheap, and could also be expensive in a political sense if the wrong people get pissed off aboit it.. If paranoia is what drives your question, then ask yourself, are you a high profile politician? A billionaire? A high profile leader of a movement like Martin Luther King Jr? Someone actually worth spending several millions of dollars on to spy on? If you're a simple petty theif or protestor than i wouldn't bother worrying about this.

*If you're worred about your personal data getting taken and spied on., your bigger worry is the browser you use and what data gets stored on servers for services you use. Those are waaaaaaaay less expensive to get into.

Tl;dr

So basically, id only worry about relying on apps owned by the government. Or the services you use that take your data to sell it to advertisers, because theyll give it to the government directly as well.

6 comments

I would bet that some devs could be persuaded by some governments, but I don't suspect that any major company would do that without MAJOR benefits to themselves.
Which means, yes, it's probably happened, and will again, and they were probably Chinese or Russian apps.
- google does for sure. a few years ago they demanded all developers to hand in their keys in the pretense of efficiency
Probably, but they don’t really have to. Exploiting the OS itself is way better.
Probably. Though they would probably rather go through Apple or Google to do it.
Depending on the country Yes.
Australia for example has the Technical Access and Assistance laws for this specific purpose.
Now, consider Australia is part of Five Eyes that means US, NZ, UK, and Canada has this capability via proxy.
Android app dev here, i cant tell you what governments are capable of, but i can describe for you some of the complicating factors preventing them from doing this.
For one, to prevent impersonation, apps are cryptographically signed by the developer using a private key they never share with anyone (like a password), and the public key is sent to Google Play and the App Store so that they can verify the identity of the uploader. This prevents app store listings from being hijacked by rivals, competetors, hackers, pirates, foreign governments, and yes, their own government. So, any goverment cant just walk up and push a rogue update to the store.
For two, deploying app updates isn't my job, it's Google's and Apple's. In my opinion if the government wanted to hijack the supply chain, going directly to Apple or Google would be the way to do it. The narrowest group of people I can push updates to are the people who opted into alpha or beta versions. To target an individual, youd have to do it through Google or Apple.
For three,, my boss barely gives me enough time and resources to meet the company's own goals, let alone letting me clean up tech debt. The idea of a government that twists my boss's arm to force me to work for the government instead of the shareholders is kinda funny and nonsensical. I live in the USA, where shareholders are king. I bet that even if we went full toltalitarian this would never happen because of rich people backlash. So i dont think the hacking coming from inside a company would happen. Then again, i perhaps dont work for a juicy enough place to see how a government could solve this problem, *or maybe they would be stupid enough to incur the political expense anyway.
And last, money money money. Programmers are not cheap. Designing and dedicating and selecting targets for an attack isnt cheap. Hacking into a company to steal their private key isnt cheap, and could also be expensive in a political sense if the wrong people get pissed off aboit it.. If paranoia is what drives your question, then ask yourself, are you a high profile politician? A billionaire? A high profile leader of a movement like Martin Luther King Jr? Someone actually worth spending several millions of dollars on to spy on? If you're a simple petty theif or protestor than i wouldn't bother worrying about this.
*If you're worred about your personal data getting taken and spied on., your bigger worry is the browser you use and what data gets stored on servers for services you use. Those are waaaaaaaay less expensive to get into.
Tl;dr
So basically, id only worry about relying on apps owned by the government. Or the services you use that take your data to sell it to advertisers, because theyll give it to the government directly as well.