4 ms·

What are the best ways to test for backdoors though? Phoning home I get. But what about just breaking in because there's a backdoor left in for when "they" sing

by kaliqt 3y ago

What are the best ways to test for backdoors though? Phoning home I get. But what about just breaking in because there's a backdoor left in for when "they" single you out for persecu- I mean investigation.

tptacek 3y ago
You read the compiled artifact. It's not complicated. Source code gives you valuable added context about programmer intent, which is helpful to understand how a program is structured, but you can't trust that intent if you're looking for surreptitious code anyways, and you don't need to to work out what the program is doing.
- bombolo 3y ago
  A normal app is about 20 megabytes minimum. Have fun reading. It could be very well obfuscated.
  - tptacek 3y ago
    First: almost nothing is ever obfuscated. Second: when you read source code, do you start at the lexicographic first .c file and just read downwards? No? Neither do reversers.