5 ms·

Yes indeed. I'm not buying it isn't patched in some way before it's pushed to any app stores. Especially with all the noise beforehand about how it operates and

by m0xte 6y ago

Yes indeed. I'm not buying it isn't patched in some way before it's pushed to any app stores. Especially with all the noise beforehand about how it operates and the involvement of GCHQ/NCSC in development. Edit: some digging. NHSX is run by Matthew Gould. Former Israel diplomat and tied via UK-Israel technology hub to NICE (Neptune Intelligence Computer Engineering) Ltd which is a former Israeli army surveillance and data security company among other functions. So basically a hotpot of reasons not to install this thing.

TechBro8615 6y ago
Well, it should be fairly trivial to put it through the rigor of some MITM proxies and verify that the built app is not making any unexpected network requests. I look forward to infosec twitter ripping this apart.
- m0xte 6y ago
  That would be interesting analytics but you just never know with this stuff. Even basic intercept-avoiding technology like burst encoding require very long term sampling to detect, so the thing would need to be disassembled and every line of code analysed.
sixstringtheory 6y ago
It's the same story as with Signal for iOS. How do we know the version downloaded from the App Store is the same code hosted on GitHub? I'd like to have the option to sideload it. Clearly that would involve some work on their backend, but I think that's fairer than the stuff described in this Signal GitHub issue [0] and Telegram's website [1] regarding the same thing. EDIT: if I'm wrong please leave some details for myself and others to learn more. I've worked on iOS apps for several years, and as far as I know there's no way to verify if an app downloaded from the App Store was compiled from a particular code revision. Even the same code compiled on separate machines can produce different unique binary IDs. And on the scale of difficulty, I'd say that sideloading is less difficult than jailbreaking, if that method even really works for this problem. [0]: https://github.com/signalapp/Signal-iOS/issues/641 https://github.com/signalapp/Signal-iOS/issues/641 [1]: https://core.telegram.org/reproducible-builds#reproducible-builds-for-ios https://core.telegram.org/reproducible-builds#reproducible-b...
- m0xte 6y ago
  Yes exactly that. I imagine vendor signing causes some issues there as well.
- withzombies 6y ago
  It's not possible to side-load iOS apps and still get push notifications. Also, Apple doesn't allow you to distribute applications outside of the app store (unless you violate the terms of your enterprise developer account).
  - saagarjha 6y ago
    While I'm not an expert on push notifications, shouldn't you be able to receive push notifications if you entitle your application for them and create the right certificate online?
    - sixstringtheory 6y ago
      This is my understanding. You would have to register your device in ADP and create an ad-hoc certificate for the app. If people are doing this on their own ADP accounts, then they're just testing their own builds, not receiving an enterprise deployment from some single developer.
  - httpsterio 6y ago
    Apple does allow self-hosting enterprise apps, one of the main distribution methods for in-house apps is buying a license from Apple to install your own certification on iOS and MacOS devices which will let you basically remotely install, update and sideload in-house applications. We personally opted out of it because the user's device's security would ultimately fall into our hands and at worst we have a root kit on the user's device someone might exploit.
    - kalleboo 6y ago
      FWIW, in iOS 13 Apple has finally made it so you can firewall off user personal device control from MDM control https://www.brianmadden.com/opinion/Apple-iOS-13-user-enrollment https://www.brianmadden.com/opinion/Apple-iOS-13-user-enroll...
GordonS 6y ago
A security researcher in Twitter was looking into it the other day, and found the app isn't obfuscated (they were able to decompile it "cleanly"). I'm not saying that guarantees no skullduggery is afoot, but it goes a long way - at least in it's current form, at that point in time.
- m0xte 6y ago
  That's good to know.
hadtodoit 6y ago
I wouldn't trust anything coming from Israel ever. Their government appears to have a mandate for installing backdoors, evidenced by the scrapped Iron Dome project which they wouldn't hand the source code over for. https://news.ycombinator.com/item?id=22512674 https://news.ycombinator.com/item?id=22512674
- 2rsf 6y ago
  You are doing a huge huge leap here, Iron Dome was not scrapped because of backdoors nor do we know about any (officially). Then one project doesn't mean that Israel are doing the same in other projects, and finally the mentioned company is private and has nothing to do with the government
  - hadtodoit 6y ago
    I'm not making any leaps, I provided a link that explained it. I have no trust in Israel to begin with due to their uncomfortable control over US politics, this was just further evidence to support that decision.
dTal 6y ago
...is it not possible to build the app from source yourself? I will install this app happily from F-Droid, and no other place.

by m0xte 6y ago

TechBro8615 6y ago

Well, it should be fairly trivial to put it through the rigor of some MITM proxies and verify that the built app is not making any unexpected network requests. I look forward to infosec twitter ripping this apart.

m0xte 6y ago
That would be interesting analytics but you just never know with this stuff. Even basic intercept-avoiding technology like burst encoding require very long term sampling to detect, so the thing would need to be disassembled and every line of code analysed.

sixstringtheory 6y ago

It's the same story as with Signal for iOS. How do we know the version downloaded from the App Store is the same code hosted on GitHub? I'd like to have the option to sideload it. Clearly that would involve some work on their backend, but I think that's fairer than the stuff described in this Signal GitHub issue [0] and Telegram's website [1] regarding the same thing. EDIT: if I'm wrong please leave some details for myself and others to learn more. I've worked on iOS apps for several years, and as far as I know there's no way to verify if an app downloaded from the App Store was compiled from a particular code revision. Even the same code compiled on separate machines can produce different unique binary IDs. And on the scale of difficulty, I'd say that sideloading is less difficult than jailbreaking, if that method even really works for this problem. [0]: https://github.com/signalapp/Signal-iOS/issues/641 https://github.com/signalapp/Signal-iOS/issues/641 [1]: https://core.telegram.org/reproducible-builds#reproducible-builds-for-ios https://core.telegram.org/reproducible-builds#reproducible-b...

m0xte 6y ago
Yes exactly that. I imagine vendor signing causes some issues there as well.
withzombies 6y ago
It's not possible to side-load iOS apps and still get push notifications. Also, Apple doesn't allow you to distribute applications outside of the app store (unless you violate the terms of your enterprise developer account).
- saagarjha 6y ago
  While I'm not an expert on push notifications, shouldn't you be able to receive push notifications if you entitle your application for them and create the right certificate online?
  - sixstringtheory 6y ago
    This is my understanding. You would have to register your device in ADP and create an ad-hoc certificate for the app. If people are doing this on their own ADP accounts, then they're just testing their own builds, not receiving an enterprise deployment from some single developer.
- httpsterio 6y ago
  Apple does allow self-hosting enterprise apps, one of the main distribution methods for in-house apps is buying a license from Apple to install your own certification on iOS and MacOS devices which will let you basically remotely install, update and sideload in-house applications. We personally opted out of it because the user's device's security would ultimately fall into our hands and at worst we have a root kit on the user's device someone might exploit.
  - kalleboo 6y ago
    FWIW, in iOS 13 Apple has finally made it so you can firewall off user personal device control from MDM control https://www.brianmadden.com/opinion/Apple-iOS-13-user-enrollment https://www.brianmadden.com/opinion/Apple-iOS-13-user-enroll...

GordonS 6y ago

A security researcher in Twitter was looking into it the other day, and found the app isn't obfuscated (they were able to decompile it "cleanly"). I'm not saying that guarantees no skullduggery is afoot, but it goes a long way - at least in it's current form, at that point in time.

m0xte 6y ago
That's good to know.

hadtodoit 6y ago

I wouldn't trust anything coming from Israel ever. Their government appears to have a mandate for installing backdoors, evidenced by the scrapped Iron Dome project which they wouldn't hand the source code over for. https://news.ycombinator.com/item?id=22512674 https://news.ycombinator.com/item?id=22512674

2rsf 6y ago
You are doing a huge huge leap here, Iron Dome was not scrapped because of backdoors nor do we know about any (officially). Then one project doesn't mean that Israel are doing the same in other projects, and finally the mentioned company is private and has nothing to do with the government
- hadtodoit 6y ago
  I'm not making any leaps, I provided a link that explained it. I have no trust in Israel to begin with due to their uncomfortable control over US politics, this was just further evidence to support that decision.

dTal 6y ago

...is it not possible to build the app from source yourself? I will install this app happily from F-Droid, and no other place.