4 ms·

You keep saying this, but how do we know they are actually using the code from Signal without access to source and reproducible builds? Last time you told me it

by danjoc 11y ago

You keep saying this, but how do we know they are actually using the code from Signal without access to source and reproducible builds? Last time you told me it was easy and legal to reverse engineer the code. I then asked you what tools you use to do that and you ignored the question.

tptacek 11y ago
To reverse engineer code? For big projects, I used IDA, like everyone else does. For smaller projects, I used Hopper, or, for architectures that IDA and Hopper didn't support, I'd postprocess binutils output. For an example of a more sophisticated approach, look at: https://sourcedna.com/ https://sourcedna.com/ Remember, in this case, it's especially easy to reverse, because you have the source code; all you're doing is matching the control flow graph to the original source.
- nialo 11y ago
  Do you know if there exist tools that take a binary and a source code file and attempt to automatically compare the control flow graphs? I imagine I won't ever get to it, but that sounds like an interesting problem to try to work on.
  - tptacek 11y ago
    Yes, there are. SourceDNA does a bunch of this.
- danjoc 11y ago
  Thanks for making this response. Genuinely interested. [To whomever down voted... I guess I get down voted for not showing gratitude immediately after he posted a reply? This is why I don't post here often. Quite mean people here.]
moxie 11y ago
If you want to look at the Android APK, you can use apktool to get back Java source. Hacked clients like WhatsApp+ even build new derivative products using that output, and spammers do it to get code they can use to inject messages onto the network without having to write their own software. I think it's great when people further verify WhatsApp's client security, please share your analysis!
- danjoc 11y ago
  Thank you for your tip and contributions to open signal. I appreciate that you want to get encryption into as many hands as possible, even if circumstances may not be ideal. My primary concern here is a long con. Everything is probably okay now, but after a while, people will stop looking and verifying. With WhatsApp keeping source closed, it makes that period of time shorter, I think. I will try to work your suggestion into my job :) If I'm paid to do it, I can keep doing it indefinitely, even working on tools to automate it.

by danjoc 11y ago

tptacek 11y ago

To reverse engineer code? For big projects, I used IDA, like everyone else does. For smaller projects, I used Hopper, or, for architectures that IDA and Hopper didn't support, I'd postprocess binutils output. For an example of a more sophisticated approach, look at: https://sourcedna.com/ https://sourcedna.com/ Remember, in this case, it's especially easy to reverse, because you have the source code; all you're doing is matching the control flow graph to the original source.

nialo 11y ago
Do you know if there exist tools that take a binary and a source code file and attempt to automatically compare the control flow graphs? I imagine I won't ever get to it, but that sounds like an interesting problem to try to work on.
- tptacek 11y ago
  Yes, there are. SourceDNA does a bunch of this.
danjoc 11y ago
Thanks for making this response. Genuinely interested. [To whomever down voted... I guess I get down voted for not showing gratitude immediately after he posted a reply? This is why I don't post here often. Quite mean people here.]

moxie 11y ago

If you want to look at the Android APK, you can use apktool to get back Java source. Hacked clients like WhatsApp+ even build new derivative products using that output, and spammers do it to get code they can use to inject messages onto the network without having to write their own software. I think it's great when people further verify WhatsApp's client security, please share your analysis!

danjoc 11y ago
Thank you for your tip and contributions to open signal. I appreciate that you want to get encryption into as many hands as possible, even if circumstances may not be ideal. My primary concern here is a long con. Everything is probably okay now, but after a while, people will stop looking and verifying. With WhatsApp keeping source closed, it makes that period of time shorter, I think. I will try to work your suggestion into my job :) If I'm paid to do it, I can keep doing it indefinitely, even working on tools to automate it.