Android applications come in .apk containers (basically .zip
files). These containers include the application’s bytecode, resources
and libraries, as well as a folder (named META-INF) that
holds the signature(s), generated by the developer, on different elements
of the respective application. An attacker that repackages
an application can modify its bytecode, alter its resources and libraries,
and then remove the META-INF folder and sign the application
with his/her own key.