4 ms·

This seems to be the same angle played every time the analysis of crypto tools comes up on HN. (Almost always) when someone mentions the 'impossibility of anal

by serf 10y ago

This seems to be the same angle played every time the analysis of crypto tools comes up on HN. (Almost always) when someone mentions the 'impossibility of analysis' of closed-source programs they are actually referring to the difficulty in doing so -- not actually stating that it's impossible. It is easier to look through source code. Now, if we're progressing through this conversation according to script, it will be mentioned that open source projects have had tremendous security problems, too. (OpenSSL comes to mind..) But that's beside the point expressed. The only point, and it's the point that was originally expressed, is that open source code is easier to look through than a closed code base. The hurdles posed by closed source, although not impossible to jump, significantly hinder the progress of analysis. Is this not true?

tptacek 10y ago
I'm sorry, but if you look upthread, the comment I responded to not only didn't say that verifying open source was easier, but actually made the extreme claim that there was in principle no way to verify closed source software at all. Meanwhile, addressing your (different) argument directly: sure, reading C code is easier than reading assembly code, and reading Python is easier than reading C. The easier it is to read a program the easier it is to reason about it. But: * It's not terribly difficult to reason about the functionality of messaging software in any language. * WhatsApp is an extremely high-profile target; it would be weird if people hadn't reversed it by now, since less well-known programs that are much harder to reverse have been productively (as in: findings uncovered) reversed. * The particular things we're looking for in a program like WhatsApp fall into two classes: (1) basic functional stuff like data flow that is even more straightforward to discern from control flow graphs than the kinds of things we routinely use reversing to find (like memory corruption flaws), and (2) cryptographic vulnerabilities that are difficult to spot even in source code, because they're implemented in the mathematical domain of the crypto primitives regardless of the language used to express them to computers. Sure, though. It is easier to spot backdoors in open source software. It's just not capital-H Hard to do it in closed-source software, so this open vs. closed debate about backdoors is usually a red herring.
- eeZah7Ux 10y ago
  > less well-known programs that are much harder to reverse have been productively > It's just not capital-H Hard to do it in closed-source software, so this open vs. closed debate about backdoors is usually a red herring. No, you are oversimplifying the problem a lot. In an Open Source project it is possible to create transparency in the development process by every commit public and allowing 3rd parties to mirror the sources repositories as well as perform reproducible builds, sign the artifacts and so on. Once a project has been reviewed, it becomes pretty difficult to sneak in a backdoor later or deliver a backdoored build only to some specific targets. In case of closed source smartphone applications it's very Hard to reverse engineer every single release simply because it takes a staggering amount of work. It's also Hard to verify that some unsuspecting users are receiving a "custom" apk and block the update automatically.
  - tptacek 10y ago
    Nope. Professional security people have been using binary diffing tools to solve this problem since the early 2000s.
    - andrepd 10y ago
      You keep saying this. Can you back your claims? In particular, the claim that Whatsapp has been extensively reverse-engineered?
      - tptacek 10y ago
        Are you asking me to "back up" the claim that security researchers use BinDiff tools to reverse out vulnerabilities from vendor patches? At one of the better-attended Black Hat USA talks last year, a team from Azimuth got up and stage and walked the audience through an IDA reverse of the iOS Secure Enclave firmware. Your argument is that it's somehow harder to reverse a simple iOS application?
        andrepd 10y ago
tedunangst 10y ago
Not necessarily. People who spend their days writing source code tend to think in terms of source code because that's what they know. People who spend their days analyzing binaries don't. Be mindful of the difference between difficult and unfamiliar.

by serf 10y ago

tptacek 10y ago

I'm sorry, but if you look upthread, the comment I responded to not only didn't say that verifying open source was easier, but actually made the extreme claim that there was in principle no way to verify closed source software at all. Meanwhile, addressing your (different) argument directly: sure, reading C code is easier than reading assembly code, and reading Python is easier than reading C. The easier it is to read a program the easier it is to reason about it. But: * It's not terribly difficult to reason about the functionality of messaging software in any language. * WhatsApp is an extremely high-profile target; it would be weird if people hadn't reversed it by now, since less well-known programs that are much harder to reverse have been productively (as in: findings uncovered) reversed. * The particular things we're looking for in a program like WhatsApp fall into two classes: (1) basic functional stuff like data flow that is even more straightforward to discern from control flow graphs than the kinds of things we routinely use reversing to find (like memory corruption flaws), and (2) cryptographic vulnerabilities that are difficult to spot even in source code, because they're implemented in the mathematical domain of the crypto primitives regardless of the language used to express them to computers. Sure, though. It is easier to spot backdoors in open source software. It's just not capital-H Hard to do it in closed-source software, so this open vs. closed debate about backdoors is usually a red herring.

eeZah7Ux 10y ago
> less well-known programs that are much harder to reverse have been productively > It's just not capital-H Hard to do it in closed-source software, so this open vs. closed debate about backdoors is usually a red herring. No, you are oversimplifying the problem a lot. In an Open Source project it is possible to create transparency in the development process by every commit public and allowing 3rd parties to mirror the sources repositories as well as perform reproducible builds, sign the artifacts and so on. Once a project has been reviewed, it becomes pretty difficult to sneak in a backdoor later or deliver a backdoored build only to some specific targets. In case of closed source smartphone applications it's very Hard to reverse engineer every single release simply because it takes a staggering amount of work. It's also Hard to verify that some unsuspecting users are receiving a "custom" apk and block the update automatically.
- tptacek 10y ago
  Nope. Professional security people have been using binary diffing tools to solve this problem since the early 2000s.
  - andrepd 10y ago
    You keep saying this. Can you back your claims? In particular, the claim that Whatsapp has been extensively reverse-engineered?
    - tptacek 10y ago
      Are you asking me to "back up" the claim that security researchers use BinDiff tools to reverse out vulnerabilities from vendor patches? At one of the better-attended Black Hat USA talks last year, a team from Azimuth got up and stage and walked the audience through an IDA reverse of the iOS Secure Enclave firmware. Your argument is that it's somehow harder to reverse a simple iOS application?
      - andrepd 10y ago

tedunangst 10y ago

Not necessarily. People who spend their days writing source code tend to think in terms of source code because that's what they know. People who spend their days analyzing binaries don't. Be mindful of the difference between difficult and unfamiliar.