Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?

You might for example have an open source application with developers located in multiple jurisdictions who cooperate by publishing the SHA for every version distributed by the App Store operators.

Is anyone doing this for any ssh clients, off-the-record messaging, etc. clients distributed through App Stores?

Are there any App Store for which this is known to be impossible, i.e. they often modify the source without revealing the changes to the original author?

There are of course closed source programs like Covert Browser for which no verification is possible except by the authors.

share|improve this question

3 Answers 3

up vote 5 down vote accepted

The developer of the application can check, if they wish, simply by downloading and installing the application themselves and confirming that what they get matches what they uploaded.

Random users of the markets cannot check for themselves that applications they download have not been modified by the app market. But we can probably count on developers to complain publicly if they detect this kind of misbehavior with their own app. The fact that we have not seen any public complaints of this sort suggests that it is probably either non-existent or relatively rare; it is hard to imagine Google or Apple are doing this on a large scale, as it would be too easy for someone to detect this and spread the news.

Note that, in major app markets (like the Android Market and the iPhone App STore) the connection between the app market and the user's phone is secured using SSL, so eavesdroppers and men-in-the-middle cannot modify the application while it is in transit. So it's really just Google and Apple that we have to trust.

So, in the grand scheme of things, this threat probably is not worth worrying about too much. Google and Apple have plenty of incentive not to tamper with apps that are served through their store. You should worry more about the threat of rogue, sleazy, or unsavory apps that are crafted that way by the developer.

share|improve this answer
    
There are various build environment issues that might present themselves, but I suppose the compiler version and library version are at least document in the compiled app. –  Jeff Burdges Dec 5 '11 at 0:34
1  
@Jeff, none of that stuff is relevant. Markets have the application developer upload the compiled binary version of the app (not its source code; the markets don't compile your code for you). Consequently, developers can keep a copy of what they uploaded and check that it is identical to what the market is downloading. If it is not identical, something has gone wrong. –  D.W. Dec 5 '11 at 2:33
    
Alright, I find that odd considering they claim to vet the stuff though. –  Jeff Burdges Dec 5 '11 at 3:06
2  
@Jeff, indeed, it is a puzzle, isn't it? When you say "they", I suspect you mean "Apple". No one really knows what kind of vetting Apple does for apps in their App Store. Certainly they can run the application and interact with it ("testing"). Also, they can probably identify what APIs the program may invoke, to form a risk assessment. The speculation I've heard is that they do both of these. –  D.W. Dec 5 '11 at 4:10
4  
Aren't all of the apps submitted to the app store signed by the developer? So an end user could verify its authenticity if they know what the developer's public key is? –  mehaase Dec 5 '11 at 14:43

If Apple is the villain of the story, then they do not need to modify the app; they can modify the operating system which will then patch the app dynamically when it is downloaded from the store. In other words, Apple is your friend (or, more appropriately, your god) because you have no other choice than to trust them.

(Except if you decide not to use any Apple product, of course. You still have that choice.)

share|improve this answer

Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?

I know nothing about the Apple Store and its mechanisms, or the Windows store, or whatever the Ubuntu one is called, but isn't this a case for code signing?

Provided Apple/Google/NextBigCompany haven't managed to find a usable hash collision, and your private key is reasonably well protected, this should enable safe distribution. After all, this is the whole point of the authenticode scheme.

As Thomas points out, there is no guarantee said company cannot modify the binary once it is loaded into memory. In fact, in the case of the Windows OS, they actually do it deliberately (to make your binary work, don't panic, it's not badness - see IAT fixups). But you have to decide to trust them at some point.

If Apple et al are not allowing code signed apps, they very much should.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.