Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Without being a programmer or a computer expert, how can I know if a particular program or any piece of software in general doesn't have hidden unwanted functions compromising privacy and security?

share|improve this question
    
Many of the comments are on point. Additionally, if the software runs on a *nix or bsd machine, you can put a trace on the software and observe the low level functionality (i.e. what system calls it makes.) –  Stephan Feb 7 '13 at 2:06
1  
If you were a programming expert, you could use static analysis. Basically decompile the program using IDAPro and see a map of all the system apis being called aka the ones that could do damage. Other than that you can see if the app is opening ports it should or making phone calls home by using a firewall. –  j_mcnally Feb 7 '13 at 3:09
1  
If a particular piece of software claims to do exactly nothing, then this problem is easy. –  emory Feb 7 '13 at 13:26
1  
@emory, you sohuld check NaDa: bernardbelanger.com/computing/NaDa/index.php –  That Brazilian Guy Feb 8 '13 at 13:49
1  
This concern is one of the reasons some people choose Open Source Software. If anyone can read the source code, you have a much better chance of knowing if the program does anything untoward. –  Jay Bazuzi Feb 11 '13 at 23:55

7 Answers 7

You can know whether some software does only what it announces in the same way that you can know whether the food they serve you at restaurants is poisoned or not. In plain words, you cannot, but Society has come up with various schemes to cope with the issue:

  • You can listen to friends and critics to know if the food at a given restaurant has good reputation or not.
  • You can take a sample and send it to a lab which will look for many (but not all) known poisonous substances.
  • You can ask nicely if you may observe the cook while he prepares the dishes.
  • The cook has a vested business interest in his customer being happy with the food quality, and happiness includes, in particular, not being dead.
  • Society punishes poisoners with the utmost severity and it can usually be assumed that the cook knows it.
  • You always have the extreme option of not eating there if you are too worried.

All of these can be directly transposed into the world of software. Extreme methods of ascertaining software quality and adherence to its published behaviour include very expensive and boring things like Common Criteria which boil down to, basically, knowing who made the program and with what tools.

Alternative answer: every piece of software has bugs, so it is 100% guaranteed that it does not do exactly what it is supposed to do. (This assertion includes the software which runs in the dozen or so small computers which are embedded in your car, by the way.)

share|improve this answer
18  
One of the best analogies ever –  Lucas Kauffman Feb 6 '13 at 21:40
10  
That's good. And the alternative answer is also brilliant. –  David Stratton Feb 6 '13 at 21:42
11  
The analogy covers that fine too, @cpast. You're safer eating at a well-known, well-reviewed restaurant than buying sushi from a street vendor who may just disappear after accidentally selling some bad fish. –  amalloy Feb 7 '13 at 6:01
3  
Also, you can ask for or look up the recipe and make the food yourself at home. –  Christoffer Hammarström Feb 7 '13 at 10:06
8  
Every analogy breaks down when looked at too closely. That's how analogies go: they illustrate concepts so that the human mind can digest them. As for your function, since hardware itself is not bug-free... –  Tom Leek Feb 7 '13 at 20:33

You can't, at least not with 100% accuracy. Speaking as a programmer, it's very easy to code in whatever I want, and it's not necessarily just what's advertised.

Not all unexpected activity, however, is malicious. I'm assuming you're worried more about malicious activity. Even that is not 100% possible to detect all the time, but there's hope.

You can use software that monitors things like network traffic, file activity, etc, to find clues that software is behaving in an unexpected way. For example (and I know this is just a basic tool) you can use Fiddler to see if a particular application is accessing the Internet via http(s). (Yes, I know there are better tools out there, though. Fiddler is just the first that comes to mind.) On Windows, you can use Process Monitor to get even more insight. Similar tools exist for other platforms.

There are also several other services that are available for you to use that will perform the analysis for you.

share|improve this answer
    
+1 for mentioning some tools for activity analysis. –  Koorosh Pasokhi Feb 7 '13 at 5:13
1  
Dynamic analysis doesn't buy you anything. You are stuck with the halting problem either way. A simple logic bomb written by a 12 year old will thwart all types of dynamic analysis as long as the code is dense enough. –  Longpoke Feb 20 '13 at 5:25

Especially as software becomes larger and more complicated, it becomes impossible* for even experts to answer that. To that extent, privacy and security from an application are best handled by using sandbox or Mandatory Access Control methods. The idea is behind these methods is that the software is run in a system that controls what it can do and you permit it to only do what you expect it to do. Done properly, you can limit possible connections, and be notified if the program ever tries to access files you didn't expect it to. Very advanced methods can be used to monitor memory or decrypt network traffic through a proxy service.

In short, if you can't understand everything it does, the answer is to restrict everything it can do with something it runs inside of (the operating system).

share|improve this answer
2  
There is a dangling asterisk after your "impossible" but, by right, you should quote Donald Knuth and MetaPost here. –  Tom Leek Feb 6 '13 at 21:42
    
The dangling asterisk implies that the time wouldn't be infinite, just too damn long. –  Jeff Ferland Feb 7 '13 at 8:36
1  
typical sandboxes (VM,java,etc)/MAC/ACL/DAC etc have all failed. The only model I know that currently is known to work is the capability model. On the other hand, if you are stuck using *nix, your only choice is really the things you mentioned. –  Longpoke Feb 7 '13 at 20:25
    
@Longpoke SELinux, at least, controls every system call and thus includes capability control. –  Jeff Ferland Feb 7 '13 at 20:37
    
@JeffFerland I'm not talking about linux capabilities, I'm talking about the capability model. –  Longpoke Feb 7 '13 at 20:44

In his widely known ACM Turing Award Lecture "Reflections on Trusting Trust" (now almost exactly 30 years ago!) Ken Thompson said "You can't trust code that you did not totally create yourself." In practice commercial software are no exception to other commercial products in that those from producers having good names on the market usually have a higher probability of being better. However there is no absulute guarantee for that. Decades ago I got diskettes from a reknown producer that had virus. In that case I personally believe that that was not a malicious act of anyone inside the firm but that some computers of the firm got infected by virus from the outside. However it is evidently not possible in general to 100% exclude the possibility of backdoors being introduced into the software by insiders of the firm, whether this is known to its CEO or not. Backdoors could be IMHO an extremely critical issue, now that cyber-wars are looming in the world. A secret agency of a government could namely manage in some way (via money, coersion or even malware) to have such backdoors implanted in certain software that normally serve to ensure the security of communications (e.g. those relevant to digital signatures) and that are sold to and used by certain non-friendly or potentially non-friendly foreign nations and either immediately or at some appropriate later time points ("time bombs" etc.) exploit the backdoors to achieve their goals of disrupting the target nations' critical infrastructure, etc. etc. Stuxnet, Flame and Gauss are a couple of names that should give some indications of the capabilities of the potential malfaiteurs.

share|improve this answer
2  
Extending your point... Even if you do compile from source that you wrote yourself... Who is to say that the compiler you use isn't doing something nefarious (assuming you didn't write the compiler from assembly...) –  Josh Feb 7 '13 at 17:13
    
@Josh: It all depends on how high your stake is. Not only application software but also compilers, OS and firmware/hardware could be potential sources of danger. You have to wisely decide what safety measures are necessary in your case and what are superflous (and take the responsibilities for omissions). In December 2012 there was a US DAPRA conference aiming to find, shut backdoor malware holes in commercial IT devices (fbo.gov/…). See in particular the section "Background" in the pdf-file it links to. –  Mok-Kong Shen Feb 7 '13 at 20:51
1  
@Josh - Then there's the hardware. This is why, to build my computer, I started with sand to make silicon. Of course, I'm not quite finished with it yet... ;) –  Nathan Long Feb 8 '13 at 19:13
    
@NathanLong: According to informations from normal media there is at least one country working to develop chips of their own, aiming thus to be independent of the designs like those of Intel. I speculate though don't know whether the security issue couldn't eventually also be a minor motivation for that project. –  Mok-Kong Shen Feb 9 '13 at 8:28

It ultimately comes down to trust. Do you trust the reputation of the company releasing the software. If it is open source, is it used by enough developers that they would be raising flags if there were issues. There is a certain amount of strength in numbers since a commonly used product is more likely to have extensive research done on if it is trustworthy. Unless you are very paranoid, generally looking at what the community has to say about a particular piece of software is the best bet, but there will still always be bugs and there will still always be mistakes.

share|improve this answer
    
One should note what is commonly overlooked regarding open-source software: There is no technical means which would guarantee that some binary/compiled program was built from exactly the source code it claims it was built from. –  Hanno Binder Feb 7 '13 at 15:44
    
@HannoBinder - true, though you also have the option to build your own version and while not simple, if well done, it should be doable for a limited technical user. –  AJ Henderson Feb 7 '13 at 15:56

Unfortunately, you can't...

As a good programmer could be called wizard by his users, a good trojan would completely fake a normal environment for make victim quiet.

Some virus/trojan do a sanitization of victim system, in order to

  • ensure another virus won't break his work
  • ensure an anti-virus won't find him
  • make the victim system work fine for ensuring victim stay confident.

So, you can't!! If in doubt consult!!!!

share|improve this answer

As pointed out by others, there is no guaranteed way to know. A lot of the time, you have to trust the integrity and reputation of the vendor. Following secure practices, such as only installing software from sources you trust can help, but just like real life, sometimes, we trust the wrong people.

In the end, I think we should adopt a certain level of paranoia. If you install an app on your phone, don't just accept or say yes when your phone OS informs you the phone wants access to your private information, your location, etc. Ask yourself, why does it need that access. If you feel the access the application is requesting is justified based on what you are expecting it to do, then saying yes maybe OK. On the other hand, if it seems to be requesting access to information or services which are way outside what it should need or be interested in, then be a little suspicious and consier carefully before just saying yes.

share|improve this answer

protected by Jeff Ferland Feb 6 '13 at 21:45

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.