4

What's the auditing/vetting process like to get an Android app into the F-Droid repository? To ask it another way, what's to stop an evil developer from uploading a backdoored Android app to the F-Droid repos?

  • 1
    Considering that they display if an app has Anti-Features or not, I guess there is some auditing going on (or is that self-reported?). At the end of the day, it has to be open source though, so it's up to you to decide if you trust blindly or inspect the code first. A google play app is on the market within 2h, and doesn't need to be open source, so take that as you will. – MPS Dec 19 '18 at 6:26
1

There definitely are dangers around downloading apps from third-party repositories. See this recent example, where an app hosted on a third-party repo stole money from user's PayPal accounts once installed.

As for F-Droid inparticular, their developer documentation doesn't elaborate on how/if they audit submissions. This may be because:

  1. They don't audit submissions.
  2. They do audit, but don't want to disclose information about the process as this may make it easier for malicious users to bypass said process.
  3. They do audit, but haven't published the details as they haven't had time or it's not a priority for them.

The only way to get more information about their audit process is probably to reach out to them and ask, but overall I would advise caution when downloading apps from a third-party repository. It is very much possible for these apps to be backdoored or contain malicious code.

1

The "Security Module" as per the link below clearly states the following:

Their security precautions:

additional security precautions are taken to make it as hard as possible to exploit this vector.

  • included on the HSTS preload list, so major browsers will only ever use HTTPS for all connections to f-droid.org
  • a strong TLS/HTTPS configuration
  • a strong HTTP Content Security Policy
  • PGP-signature on the initial install download link
  • automated regular and random auditing that F-Droid.apk has not been tampered with
  • F-Droid Limited controls many potential phishing domains like fdroid.org, f-droid.com, and f-dro1d.org.
  • website is statically generated to greatly reduce the attack surface
  • website is fully functional when Javascript is disabled in the browser, eliminating all possibility of XSS attacks

And as for the in-app application:

Protecting against malicious contributor-generated data

  • The app descriptions are submitted by all sorts of people, and they can also be taken from the app’s source repository. This data is ultimately delivered to the Android client or the user’s browser via f-droid.org.

  • the Android client never runs CSS, Javascript, or dangerous HTML tags since it displays HTML via android.text.Html.fromHtml() with image loading disabled

  • the f-droid.org website protects against malicious and CSS/HTML/Javascript injection with a strict HTTP Content Security Policy.
  • Repomaker filters the texts through Mozilla’s bleach and has a good HTTP Content Security Policy.

Answering your question: (Reddit Source)

As others have said, we don't audit every single app that makes it into the store. But we do make sure that everything is free software, and do test/investigate to a certain degree.

There was recently a study made of the amount of malware apps in each app store for Android. I can't find it now, but IIRC it was a pdf and should have been published in the past year. Basically, what it said is that many alternative stores smaller than Google Play were close to having no malware, but only one had absolutely none: F-Droid.

I guess what I'm trying to say is that we're not bulletproof, and we never said we were. Our only promise to the users is that the apks we distribute come from the source that is publicly available, and have been built and distributed by the F-Droid server tools which are also free software. So far, this policy seems to have worked well :)

Links:

https://www.reddit.com/r/privacy/comments/3cjj2e/how_secure_is_fdroid/ Reddit, Answering the OP's Question

https://f-droid.org/en/docs/Security_Model/ Source

https://f-droid.org/en/2018/09/04/second-security-audit-results.html Recommended

  • Could you edit your answer to elaborate a little bit on how those links answer the author's question? Only links as answer is considered bad practice. – Luc Dec 19 '18 at 10:33
  • 1
    Thanks! I wasn't sure if I was overlooking the answer in the linked pages. This explains how F-Droid prevents malicious content on their own pages (like in the description field), but I think OP is asking if F-Droid does anything to prevent someone from uploading malicious APKs to the repository. – Luc Dec 19 '18 at 11:03
  • 1
    Nice find, that reddit post. I didn't know that! Now I'm even happier to be using F-Droid than I was already :) – Luc Dec 19 '18 at 16:05

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.