4 ms·

We have no idea if whatsapp really implements it, and if it does but also adds a bunch of side channels for the NSA.

kasey_junk 3y ago
This idea seems to rely on the flawed assumption that you can’t security audit closed source software. This is not an assumption I’ve ever seen an actual security researcher make. Quite the opposite, they start with techniques they work on the binary and only use the source (if available) as a helpful reference. Hiding back doors in source has a long and storied history so relying on it to audit security has long been out of favor.
- kaliqt 3y ago
  What are the best ways to test for backdoors though? Phoning home I get. But what about just breaking in because there's a backdoor left in for when "they" single you out for persecu- I mean investigation.
  - tptacek 3y ago
    You read the compiled artifact. It's not complicated. Source code gives you valuable added context about programmer intent, which is helpful to understand how a program is structured, but you can't trust that intent if you're looking for surreptitious code anyways, and you don't need to to work out what the program is doing.
    - bombolo 3y ago
      A normal app is about 20 megabytes minimum. Have fun reading. It could be very well obfuscated.
      - tptacek 3y ago
        First: almost nothing is ever obfuscated. Second: when you read source code, do you start at the lexicographic first .c file and just read downwards? No? Neither do reversers.
jimllo 3y ago
You can check it yourself with reverse engineering tools, e.g. on Android you could look at the APK with jadx and see the decompiled Signal implantation, and how it compares to the open source Java library from Signal that it is derived from.
- NoImmatureAdHom 3y ago
  Would it be unfair of me to rephrase as, "It is possible to do this ridiculous, difficult thing that doesn't even always work in order to get some insight into a situation which would be trivial if the source were available with reproducible builds"?
  - TillE 3y ago
    Reverse engineering is not onerously difficult if you have the right tools, some experience, and a decent grasp of assembly language. It's only really annoying if you can't use a debugger.
    - georgeplusplus 3y ago
      Any good resources you recommend for a noob to the art who doesn't know assembly? I've reverse engineered file types. But not actual code.
      - ldarby 3y ago
        You just need to understand assembly. Maybe there are books that can help, I'm not aware of any, but to get started I'd recommend taking a binary of any open source software (preferably a non-optimised build, or just your own hello world with some loops etc), run it in a debugger, and step through each assembly instruction at a time and figure out what it's doing, with the corresponding source code. Eventually you may be able to do this without needing the source code, which is the goal. I think this is about the same effort as learning a new language (spoken, not programming), i.e. it'll take months of being immersed in it to get good at it. On the other hand, maybe your binary can be decompiled to source code (e.g. CFR can decompile java classes, I've used that a bit but haven't checked if that's useful for Android apps).

This idea seems to rely on the flawed assumption that you can’t security audit closed source software. This is not an assumption I’ve ever seen an actual security researcher make. Quite the opposite, they start with techniques they work on the binary and only use the source (if available) as a helpful reference. Hiding back doors in source has a long and storied history so relying on it to audit security has long been out of favor.

kaliqt 3y ago
What are the best ways to test for backdoors though? Phoning home I get. But what about just breaking in because there's a backdoor left in for when "they" single you out for persecu- I mean investigation.
- tptacek 3y ago
  You read the compiled artifact. It's not complicated. Source code gives you valuable added context about programmer intent, which is helpful to understand how a program is structured, but you can't trust that intent if you're looking for surreptitious code anyways, and you don't need to to work out what the program is doing.
  - bombolo 3y ago
    A normal app is about 20 megabytes minimum. Have fun reading. It could be very well obfuscated.
    - tptacek 3y ago
      First: almost nothing is ever obfuscated. Second: when you read source code, do you start at the lexicographic first .c file and just read downwards? No? Neither do reversers.

jimllo 3y ago

You can check it yourself with reverse engineering tools, e.g. on Android you could look at the APK with jadx and see the decompiled Signal implantation, and how it compares to the open source Java library from Signal that it is derived from.

NoImmatureAdHom 3y ago
Would it be unfair of me to rephrase as, "It is possible to do this ridiculous, difficult thing that doesn't even always work in order to get some insight into a situation which would be trivial if the source were available with reproducible builds"?
- TillE 3y ago
  Reverse engineering is not onerously difficult if you have the right tools, some experience, and a decent grasp of assembly language. It's only really annoying if you can't use a debugger.
  - georgeplusplus 3y ago
    Any good resources you recommend for a noob to the art who doesn't know assembly? I've reverse engineered file types. But not actual code.
    - ldarby 3y ago
      You just need to understand assembly. Maybe there are books that can help, I'm not aware of any, but to get started I'd recommend taking a binary of any open source software (preferably a non-optimised build, or just your own hello world with some loops etc), run it in a debugger, and step through each assembly instruction at a time and figure out what it's doing, with the corresponding source code. Eventually you may be able to do this without needing the source code, which is the goal. I think this is about the same effort as learning a new language (spoken, not programming), i.e. it'll take months of being immersed in it to get good at it. On the other hand, maybe your binary can be decompiled to source code (e.g. CFR can decompile java classes, I've used that a bit but haven't checked if that's useful for Android apps).