How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?

Question

Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?

You might for example have an open source application with developers located in multiple jurisdictions who cooperate by publishing the SHA for every version distributed by the App Store operators.

Is anyone doing this for any ssh clients, off-the-record messaging, etc. clients distributed through App Stores?

Are there any App Store for which this is known to be impossible, i.e. they often modify the source without revealing the changes to the original author?

There are of course closed source programs like Covert Browser for which no verification is possible except by the authors.

Answer 1

The developer of the application can check, if they wish, simply by downloading and installing the application themselves and confirming that what they get matches what they uploaded.

Random users of the markets cannot check for themselves that applications they download have not been modified by the app market. But we can probably count on developers to complain publicly if they detect this kind of misbehavior with their own app. The fact that we have not seen any public complaints of this sort suggests that it is probably either non-existent or relatively rare; it is hard to imagine Google or Apple are doing this on a large scale, as it would be too easy for someone to detect this and spread the news.

Note that, in major app markets (like the Android Market and the iPhone App STore) the connection between the app market and the user's phone is secured using SSL, so eavesdroppers and men-in-the-middle cannot modify the application while it is in transit. So it's really just Google and Apple that we have to trust.

So, in the grand scheme of things, this threat probably is not worth worrying about too much. Google and Apple have plenty of incentive not to tamper with apps that are served through their store. You should worry more about the threat of rogue, sleazy, or unsavory apps that are crafted that way by the developer.

Answer 2

If Apple is the villain of the story, then they do not need to modify the app; they can modify the operating system which will then patch the app dynamically when it is downloaded from the store. In other words, Apple is your friend (or, more appropriately, your god) because you have no other choice than to trust them.

(Except if you decide not to use any Apple product, of course. You still have that choice.)

Answer 3

Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?

I know nothing about the Apple Store and its mechanisms, or the Windows store, or whatever the Ubuntu one is called, but isn't this a case for code signing?

Provided Apple/Google/NextBigCompany haven't managed to find a usable hash collision, and your private key is reasonably well protected, this should enable safe distribution. After all, this is the whole point of the authenticode scheme.

As Thomas points out, there is no guarantee said company cannot modify the binary once it is loaded into memory. In fact, in the case of the Windows OS, they actually do it deliberately (to make your binary work, don't panic, it's not badness - see IAT fixups). But you have to decide to trust them at some point.

If Apple et al are not allowing code signed apps, they very much should.