4

How do we know any device is doing what it is supposed to do? For example, Android is an open-source OS (ignore google libraries for now) and they do claim that all passwords will only be stored on the device. But what if they are storing it on their servers and this piece of code is not in the open-source version but it is there only in pre-compiled libraries? How do we check that the same code is there in the actual phone and open source version? Same goes for other devices like iPhones, routers, desktops etc.

Also, most manufacturers nowadays have encryption enabled which makes it impossible to monitor the actual content on the TCP/IP packet.

We can always remove the existing OS and install the open-source version but that's not possible in all cases, as in some it might be really confusing and might even need a lot of extra stuff that people don't usually have.

So my general question is how do we verify if the same code is there in the open-source version and pre-compiled binaries? I can think of reverse engineering but that would require great knowledge and skills which most people don't have.

2
  • 1
    For compiling code in particular, the classic reference is Trusting Trust by Ken Thompson, one of the creators of Unix. (Note: I have the same fairly common surname, but am not related TTBOMK.) – dave_thompson_085 Oct 16 '19 at 10:34
  • @dave_thompson_085 thank you very much. I will surely look into it. – Samvid Kulkarni Oct 16 '19 at 15:22
6

There is a saying at my company:

Quality Assurance is making sure that something does what it's supposed to. Security Assurance is making sure that it does only what it's supposed to.

So unfortunately, I think your questions will lead you to a full security audit or penetration test, which, as you point out, requires great knowledge and skills which most people don't have.

5
  • are there any tools which normal person can use without much detail knowledge and understand of penetration testing? – Samvid Kulkarni Oct 16 '19 at 15:22
  • @SamvidKulkarni tools to do what? What exactly are you trying to do? – Mike Ounsworth Oct 16 '19 at 15:29
  • like try to find what data is transmitted over the network before it send like reading the contents of tcp/ip packet before it send? or reading whats in memory before it is encrypted and written to disk? etc. – Samvid Kulkarni Oct 16 '19 at 17:03
  • @SamvidKulkarni Hmm. Have you tried wireshark? Are the tcp packets encrypted with TLS? Is the memory linux or Windows? – Mike Ounsworth Oct 16 '19 at 17:58
  • I have and all packets are encrypted by default. Even if I remove the encryption, any communication between company server and my device is encrypted and there is no way to remove it. – Samvid Kulkarni Oct 17 '19 at 22:51
6

... how do we know any device is doing what it is supposed to do

We don't. But this lack of absolute certainty is not specific to IT security.

If you talk to your friends you don't know for sure if the they are telling the (full) truth. If you buy something you don't know for sure if it actually has all the qualities the vendor claims.

But it is not that you merely blindly hope that everything will be fine: you believe your friends because of the good experiences you had so far and because if somebody found out the lies they would risk to loose your friendship. You trust some vendors more than others for example because trusted friends recommend these or because some important brand would had too much too loose if they lied too much.

The same is true with devices you buy. Given that many lies about the quality eventually are detected (like built-in backdoors, selling your privacy, ...) major brands try their best to not lie to you since they have a lot to loose. Trust in the quality of their products is part of their business model. Contrary to this cheaper brands have not much too loose. Therefore it is more likely to find bugs, bad quality of the hard- and software and even backdoors in products from such cheap brands.

I can think of reverse engineering but that would require great knowledge and skills which most people dont have.

For the major brands it is usually enough of a risk that someone with enough skills will have some spare time (or even get paid for this) to dig deeper. And major brands have usually more customers and maybe even some customers who are willing to invest time or money in such analysis, like when using such devices in a business or government environment.

Cheaper brands on the other hand have both less exposure and have much less too loose, which means they also care much less. They might even use this limited exposure and risk as its own business value: since they have none or only few credibility in the first place they can easily partner with shady companies or organizations without loosing credibility. This results for example in cheap mobile phones coming pre-installed with adware or other PUP.

How do we cross-verify if the device is doing exactly what it is supposed to do?

As you already found out yourself: for the average person this is impossible. And even for experts it would be too costly and time-consuming to analyze every new device they use.

In the end it boils down to the trust you can have in the vendor. And as is with friends: such trust is hard (and maybe costly) to gain but much easier to loose. Thus major brands try to keep their hard-gained reputation up which makes it much less likely that you encounter serious issues on their devices - at least compared to the cheaper brands which have not much reputation anyway.

3
  • 1
    And Stackexchange itself is a concrete implementation of such a reputation-based system, using fairly clear rules that sometimes are understood, recursively, by asking and trusting people on meta-Stacks! – dave_thompson_085 Oct 16 '19 at 10:34
  • I agree with you. Trust is everything. But that same thing can be used other way as well. Most people will think that companies won't do anything bad just to keep their reputation and thats exactly when they do stuff they are not supposed to do like facebook and its tracking and stealing the user data. – Samvid Kulkarni Oct 16 '19 at 15:25
  • 2
    @SamvidKulkarni: Trust is hard to gain but easy to loose. The chance is high that misuse of trust will be eventually detected, like by chance, by a whisteblower or because someone took the time to dig deeper (and maybe got paid for this). But sometimes the money which can be earned by misusing the trust might actually seem to be worth to take the risk as past has shown. This risk can be increased by protecting and encouraging whistleblowers by law, doing audits and having the ability to severely punish companies by law so that it is not only reputation they can loose. See GDPR. – Steffen Ullrich Oct 16 '19 at 15:40
1

Practically, you can't really verify that it is the same code.

You might be able to probe that it is not the same if you found Android sending one of your passwords, which it was not supposed to do in the original code, but checking that their compiled code is the same as the published one is not feasible to verify.

If you want to verify that the binary code of program X is the result of compiling the source code Y that was published, what you should do is to build it yourself.

Thus, for instance, you could install LineageOS instead of an official build by the phone manufacturer, but you would have the same requisite of needing to trust their developers not to have build a malicious program. In order to be sure that it corresponds to the published code, you would need to compile it yourself (it is feasible, but more work), on a trusted machine with a trusted compiler

Note that you face the same trust problem with any other OS and program, from Windows (where you don't even have the source available) to Linux and BSD. These free *nix distributions generally avoid the problem of a program binary being different than the alleged source code by them being compiled by the distribution (which you need to trust, but it's just a single entity you need to trust), or in some cases (e.g. Gentoo) it is the user that builds it himself.

There are programs which are designed in such way that every compilation produces the same binary (this is termed reproducible builds). That would allow anyone to verify that the result is the result of the compilation. Sadly, the normal case is that the builds are not reproducible, and special tweaking is needed to make the compiler produce exactly the same binary on every compilation.

Then, you should start analyzing if the published source code was malicious...

¹ Still, you will find that these versions use closed drivers as binaries, some might contain already-compiled binaries, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.