3 ms·

Verifying that the build came from the developer tells you nothing about whether the app has been backdoored when your adversary controls the compiler used to b

Verifying that the build came from the developer tells you nothing about whether the app has been backdoored when your adversary controls the compiler used to build the app and the operating system used to execute the app. Reflections on Trusting Trust explains why: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

gruez 5y ago
If the SDK was backdoored it would show up on everyone's downloads, which greatly increases the chances of detection. Conversely, if the binaries were uploaded to an app store and were only signed by the app store itself, it's impossible to know whether you got a backdoored version or not.
- Skunkleton 5y ago
  What do you mean it would "show up in everyones downloads"? Google Play Services are constantly being updated on peoples phones. Literally nothing besides Google's decision not to prevents these updates from containing a backdoor.
  - Avamander 5y ago
    Google Play Services is still bound by Android's own security mechanisms, it can't do everything but it can do a lot, yes.
    - izacus 5y ago
      It can silently replace APKs which is exactly what the conversation here is about. It's more than enough.
      - Avamander 5y ago
        It can't. It can uninstall them, but then the app doesn't have any data after reinstallation.
        iggldiggl 5y ago
        I have no idea whether there are any APIs the Play Store has access to which expose that feature, but through ADB (or directly calling the package manager from the shell of a rooted device) you have been able to instruct Android to keep the app data even after uninstalling for a long time already. (I haven't actually tried whether you can really successfully switch signatures on an APK that way without losing all user data, tough) Additionally, starting from Android 10 it seems that there is a new official feature allowing data to be kept after uninstallation if an app opts-in (https://stackoverflow.com/questions/58750567/how-to-enable-option-to-keep-apps-data-on-uninstall-prompt https://stackoverflow.com/questions/58750567/how-to-enable-o...).
      - dbrgn 5y ago
        Can it? Does it run with root permissions? (Honest question, I don't know.) If it's bound by the OS permission system and doesn't have full root, it might be able to replace apps with another version that is signed by a different key (using the "programmatic app installing" permission). However, that would wipe the app data and break app updates. Not even adb can replace an app with one that is signed by a different key without data loss (adb install -r). And I'm sure a lot of developers ask for this feature.
- nodamage 5y ago
  > If the SDK was backdoored it would show up on everyone's downloads, which greatly increases the chances of detection. I think you have far too much confidence in this. How exactly would the average Android developer check to see if the SDK they downloaded from Android Studio doesn't have a targeted exploit in it? Or Android Studio itself for that matter?

gruez 5y ago

If the SDK was backdoored it would show up on everyone's downloads, which greatly increases the chances of detection. Conversely, if the binaries were uploaded to an app store and were only signed by the app store itself, it's impossible to know whether you got a backdoored version or not.

Skunkleton 5y ago
What do you mean it would "show up in everyones downloads"? Google Play Services are constantly being updated on peoples phones. Literally nothing besides Google's decision not to prevents these updates from containing a backdoor.
- Avamander 5y ago
  Google Play Services is still bound by Android's own security mechanisms, it can't do everything but it can do a lot, yes.
  - izacus 5y ago
    It can silently replace APKs which is exactly what the conversation here is about. It's more than enough.
    - Avamander 5y ago
      It can't. It can uninstall them, but then the app doesn't have any data after reinstallation.
      - iggldiggl 5y ago
        I have no idea whether there are any APIs the Play Store has access to which expose that feature, but through ADB (or directly calling the package manager from the shell of a rooted device) you have been able to instruct Android to keep the app data even after uninstalling for a long time already. (I haven't actually tried whether you can really successfully switch signatures on an APK that way without losing all user data, tough) Additionally, starting from Android 10 it seems that there is a new official feature allowing data to be kept after uninstallation if an app opts-in (https://stackoverflow.com/questions/58750567/how-to-enable-option-to-keep-apps-data-on-uninstall-prompt https://stackoverflow.com/questions/58750567/how-to-enable-o...).
    - dbrgn 5y ago
      Can it? Does it run with root permissions? (Honest question, I don't know.) If it's bound by the OS permission system and doesn't have full root, it might be able to replace apps with another version that is signed by a different key (using the "programmatic app installing" permission). However, that would wipe the app data and break app updates. Not even adb can replace an app with one that is signed by a different key without data loss (adb install -r). And I'm sure a lot of developers ask for this feature.
nodamage 5y ago
> If the SDK was backdoored it would show up on everyone's downloads, which greatly increases the chances of detection. I think you have far too much confidence in this. How exactly would the average Android developer check to see if the SDK they downloaded from Android Studio doesn't have a targeted exploit in it? Or Android Studio itself for that matter?