When thinking about which messaging solution to use on my new \"smart\"phone I r

Question

When thinking about which messaging solution to use on my new "smart"phone I reflexively tended towards open source products, figuring that I could trust these more to actually provide the security they promise.

Now that I have decided which to use and installed the app from an app store, I have been asking myself: even if I had checked the source code (I'll admit I have just been assuming that someone did), how could I know that that is what I installed?

I see at least two potential attack vectors:

1. The app provider can ship different code than what they publish (e.g. via Github).
2. The app store owner (i.e. Google, Apple, ...) can change the shipped code.

I estimate that as little as one or two extra (or missing) lines can render even the most solid setup completely open to attack without the user being the wiser.

So, is there a way (preferably an automated one) to verify that the apk I downloaded from the app store matches the code I can see elsewhere?

Explanation / Answer

Here is an idea of how you could verify the integrity of source code in a binary package:

Download the apk from a distributer, such as Google Play, and store the apk locally. Then compile the source code into an apk to create a sort-of identical version of the app.

Then do a binary comparison of 2 apk files and look for any differences and note their location. Then, disssemble both items with a tool such as IDA Pro and mnually check what the differences in the code are.

You can expect some differences, because the signing certificates wont match, but the underlying code should be the same, if not identical.

As an example, you might see that google version of the app has several functions that are not present in source, which can indicate some modifications to the original source.

Related Questions

Navigate

• Browse (All)
• Browse W
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.