The signature loophole is widely used.

In July 2013, foreign security vendors referred to a system signature flaw in 99% of Android phones, which could allow attackers to implant mobile viruses into normal Android apps. August 6, Jinshan mobile phone poison PA monitoring system found that the domestic use of Android system Signature vulnerability spread of more than 4,000 Android virus, a network of applications in the market to download the top ten applications are all viruses, it is recommended not to download the mobile phone software from this website. An attacker implanted a virus into a popular normal Android software, and because of the presence of an Android signature flaw, Android malware, after the virus was implanted, also had a normal file signature. To upgrade and install files with a normal signature, the Android system will not have a "signature mismatch" warning message. Moreover, documents with the normal signature of large companies are easily missed by careless analysts or security software. Jinshan Poison PA Scanned the software provided by the Anfeng network market, which found more than 4,000 Android software, which downloaded the top 10 software. The number of these Android viruses has been downloaded more than 2 million, and the earliest time to intercept the site containing the system's signature vulnerability to Android virus was July 16, 2013. These viruses start when a phone starts, connects, or disconnects a USB power cord, network change, screen unlocking, and so on. The virus will determine whether the system root, and then check whether the phone to install the common security software, there is no malicious action to perform the installation. If the security software is not installed, the virus will open the network in the background, read the local phone number and address book, fake cell phone contact person on the poisoned cell phone generated scam messages.