does it really work? rekey.app claims to protect agains Master Key vulnerabilities The android app rekey claims that it can protect android device against "Master Key" vulnerabilities

on their website they have a test/proofOfConcept

To verify that your device has been patched, you can 
attempt to install a [PoC APK] to test whether it is properly 
blocked by ReKey." 


I first installed rekey (version 1.0.4 dated July, 21th 2013) and then PoC APK but got no warning that PoC is not ok.


Does that mean does rekey does not work at all?
Or does it not work on my rooted android 2.2 smartfone?
Or is PoC APK not a proove of concept?


What is your experience/option?

Can you confirm that it is working or not working on your device?
I'd be extremely worried there!

The MasterKey vulnerability exploit works in the handling of ZipEntry (see below - Bug 8219321), which is buried deep in the ROM itself, its used in the PackageManager layer as well. 

For such an application claiming "to patch" it, is misleading and false, because it is a user application and not at system level. 

The real cure to get around the vulnerability is to modify the source code in Android in itself and rebuild the ROM.

The vulnerability exploits ROMs from Donut (1.6) right up to Jellybean (4.2).

In the FAQ of the app's website - this made my hairs stand up:


  Can I trust ReKey with root access on my device?
  
  Did you see those seals up above? They look pretty darn official and
  trustworthy. They have Latin phrases and everything.


I really do not know whether to laugh or cry!

Dynamically patching the bytecode in the Android's Java DalvikVM (Runtime engine to the uninitiated) is unheard of.

Verdict:

I would take those so-called "claims of a user-level app" patching in Masterkey exploit, with a pinch of salt and not get fooled by it.

Source:


Masterkey Exploit (I) - Bug 8219321
Masterkey Exploit (II) - Bug 9695860


Patches:


Bug: 8219321 - Remove duplicate entries in Zip.
Bug: 9695860 - unsigned Zip Entries.