Assessing application authenticity and performing an action in response to an evaluation result

A system, comprising:

• a data repository to store component data for at least one known component of a known source;
• at least one processor;
• and
• memory storing instructions configured to instruct the at least one processor to:
• receive, from a second computing device, a known signing identifier of the known source;
• receive, from a first computing device, a first signing identifier for a first application, wherein a third computing device provides the first application for installation on the first computing device;
• challenge the known source to authenticate itself, the challenge comprising sending data to the second computing device to be signed with a private key, receiving the signed data from the second computing device, and confirming the signed data corresponds to the known signing identifier;
• in response to confirming the signed data corresponds to the known signing identifier:
• identify a first plurality of applications that are each similar to the first application and are each signed with a signing identifier that is different from the known signing identifier, wherein the identifying comprises making a comparison between a characteristic of the component data and a characteristic that has been identified in the first application, and determining that each of the first plurality of applications uses the at least one known component of the known source;
• evaluate authenticity of the first application to provide a result, the evaluating comprising determining that the at least one known component is similar to at least one first component of the first application, the similarity based on comparing a structural characteristic of the at least one first component to the component data for the at least one known component, and determining that the first signing identifier is different from the known signing identifier, wherein the evaluating is further based on a plurality of inputs comprising a history of prior usage of the first signing identifier to sign a known bad application other than the first application;
• and
• in response to the result, sending at least one electronic communication to the first computing device to block installation of the first application on the first computing device, and sending at least one communication to the second computing device regarding usage of the at least one known component, wherein the at least one communication further identifies the first plurality of applications.

A non-transitory computer-readable storage medium storing computer-readable instructions, which when executed, cause a computing system to:

• receive, over a communication network from a second computing device, a known signing identifier of a known source;
• store component data for at least one known component of the known source;
• receive, from a first computing device, a first signing identifier for a first application to be installed on the first computing device, wherein a third computing device provides the first application for installation on the first computing device;
• challenge the known source to authenticate itself, the challenge comprising sending data to the second computing device to be signed with a private key, receiving the signed data from the second computing device, and confirming the signed data corresponds to the known signing identifier;
• in response to confirming the signed data corresponds to the known signing identifier:
• identify a first plurality of applications that are each similar to the first application and are each signed with a signing identifier that is different from the known signing identifier, wherein the identifying comprises making a comparison between a characteristic of the component data and a characteristic that has been identified in the first application, and determining that each of the first plurality of applications uses the at least one known component of the known source;
• evaluate authenticity of the first application to provide a result, the evaluating comprising determining that the at least one known component is similar to at least one first component of the first application, the similarity based on comparing a structural characteristic of the at least one first component to the component data for the at least one known component, and determining that the first signing identifier is different from the known signing identifier, wherein the evaluating is further based on a plurality of inputs comprising a history of prior usage of the first signing identifier to sign a known bad application other than the first application;
• and
• in response to the result, sending, over the communication network, at least one electronic communication to the first computing device to block installation of the first application on the first computing device, and sending at least one communication to the second computing device regarding usage of the at least one known component in the first application, wherein the at least one communication further identifies the first plurality of applications.