How do I know a piece of software only does what the author claims?

Question

Without being a programmer or a computer expert, how can I know if a particular program or any piece of software in general doesn't have hidden unwanted functions compromising privacy and security?

Answer 1

You can know whether some software does only what it announces in the same way that you can know whether the food they serve you at restaurants is poisoned or not. In plain words, you cannot, but Society has come up with various schemes to cope with the issue:

• You can listen to friends and critics to know if the food at a given restaurant has good reputation or not.
• You can take a sample and send it to a lab which will look for many (but not all) known poisonous substances.
• You can ask nicely if you may observe the cook while he prepares the dishes.
• The cook has a vested business interest in his customer being happy with the food quality, and happiness includes, in particular, not being dead.
• Society punishes poisoners with the utmost severity and it can usually be assumed that the cook knows it.
• You always have the extreme option of not eating there if you are too worried.

All of these can be directly transposed into the world of software. Extreme methods of ascertaining software quality and adherence to its published behaviour include very expensive and boring things like Common Criteria which boil down to, basically, knowing who made the program and with what tools.

Alternative answer: every piece of software has bugs, so it is 100% guaranteed that it does not do exactly what it is supposed to do. (This assertion includes the software which runs in the dozen or so small computers which are embedded in your car, by the way.)

Answer 2

You can't, at least not with 100% accuracy. Speaking as a programmer, it's very easy to code in whatever I want, and it's not necessarily just what's advertised.

Not all unexpected activity, however, is malicious. I'm assuming you're worried more about malicious activity. Even that is not 100% possible to detect all the time, but there's hope.

You can use software that monitors things like network traffic, file activity, etc, to find clues that software is behaving in an unexpected way. For example (and I know this is just a basic tool) you can use Fiddler to see if a particular application is accessing the Internet via http(s). (Yes, I know there are better tools out there, though. Fiddler is just the first that comes to mind.) On Windows, you can use Process Monitor to get even more insight. Similar tools exist for other platforms.

There are also several other services that are available for you to use that will perform the analysis for you.

• http://www.cwsandbox.org/?page=submit
• http://www.threatexpert.com/submit.aspx

Answer 3

Especially as software becomes larger and more complicated, it becomes impossible* for even experts to answer that. To that extent, privacy and security from an application are best handled by using sandbox or Mandatory Access Control methods. The idea is behind these methods is that the software is run in a system that controls what it can do and you permit it to only do what you expect it to do. Done properly, you can limit possible connections, and be notified if the program ever tries to access files you didn't expect it to. Very advanced methods can be used to monitor memory or decrypt network traffic through a proxy service.

In short, if you can't understand everything it does, the answer is to restrict everything it can do with something it runs inside of (the operating system).

Answer 4

In his widely known ACM Turing Award Lecture "Reflections on Trusting Trust" (now almost exactly 30 years ago!) Ken Thompson said "You can't trust code that you did not totally create yourself." In practice commercial software are no exception to other commercial products in that those from producers having good names on the market usually have a higher probability of being better. However there is no absulute guarantee for that. Decades ago I got diskettes from a reknown producer that had virus. In that case I personally believe that that was not a malicious act of anyone inside the firm but that some computers of the firm got infected by virus from the outside. However it is evidently not possible in general to 100% exclude the possibility of backdoors being introduced into the software by insiders of the firm, whether this is known to its CEO or not. Backdoors could be IMHO an extremely critical issue, now that cyber-wars are looming in the world. A secret agency of a government could namely manage in some way (via money, coersion or even malware) to have such backdoors implanted in certain software that normally serve to ensure the security of communications (e.g. those relevant to digital signatures) and that are sold to and used by certain non-friendly or potentially non-friendly foreign nations and either immediately or at some appropriate later time points ("time bombs" etc.) exploit the backdoors to achieve their goals of disrupting the target nations' critical infrastructure, etc. etc. Stuxnet, Flame and Gauss are a couple of names that should give some indications of the capabilities of the potential malfaiteurs.

Answer 5

It ultimately comes down to trust. Do you trust the reputation of the company releasing the software. If it is open source, is it used by enough developers that they would be raising flags if there were issues. There is a certain amount of strength in numbers since a commonly used product is more likely to have extensive research done on if it is trustworthy. Unless you are very paranoid, generally looking at what the community has to say about a particular piece of software is the best bet, but there will still always be bugs and there will still always be mistakes.

Answer 6

Unfortunately, you can't...

As a good programmer could be called wizard by his users, a good trojan would completely fake a normal environment for make victim quiet.

Some virus/trojan do a sanitization of victim system, in order to

• ensure another virus won't break his work
• ensure an anti-virus won't find him
• make the victim system work fine for ensuring victim stay confident.

So, you can't!! If in doubt consult!!!!

Answer 7

As pointed out by others, there is no guaranteed way to know. A lot of the time, you have to trust the integrity and reputation of the vendor. Following secure practices, such as only installing software from sources you trust can help, but just like real life, sometimes, we trust the wrong people.

In the end, I think we should adopt a certain level of paranoia. If you install an app on your phone, don't just accept or say yes when your phone OS informs you the phone wants access to your private information, your location, etc. Ask yourself, why does it need that access. If you feel the access the application is requesting is justified based on what you are expecting it to do, then saying yes maybe OK. On the other hand, if it seems to be requesting access to information or services which are way outside what it should need or be interested in, then be a little suspicious and consier carefully before just saying yes.