6

Because of the current debate about tracking and privacy regarding the new Corona apps, I'd like to know in general, if an app or software really uses solely the code that it claims to be build on if it is open source. So how can I be sure, an app that I download from an app repository (like Googles Play Store) is truely using exactly this code? Is it possible at all?

I know that there might be other vulnerabilities (e.g. the app uses system libraries too which I have to trust). But let us consider only the app/software itself, in order to make it not to complicated.

I've got the impression that it is not truely possible. Or only with much efforts that a normal user cannot perform. Can one only trust and hope? Or how can I authenticate an app easily?

Open Source is fine (actually one of the greatest things ever!), but if I don't know whether I get what I should get, it is really bad.

1
5

It’s not possible to validate it 100% but you can get close.

As a prerequisite, the app needs to support reproducible builds. That means you need the information how to compile and package the target app exactly the same way the maintainer did, including compiler parameters.

For simple apps, the answer given by @filip is true. You compile the app and hash (MD5, SHA1) the resulting package or binary. You do the same with the app downloaded from the app store and you should get the same hash.

In reality though, this is impossible. Many apps use API keys for third party APIs that are baked into the app and unless you somehow receive the company’s production API keys, your compiled binary will differ from the app store version.

Signing is also something that will complicate a comparison because you would need the maintainer’s signing key to create an exact copy of the app.

The simplest way is to compile the app with your own API keys and then diff the 2 binaries with a program like BinDiff, IDA or the IDA plugin Diaphora.

These programs (and many other similar tools) will show you the differences between the 2 binaries. It’s fairly easy to see the small differences caused by differing API keys and large chunks of code added to one version of the app will be immediately obvious.

1
  • 1
    +1 Checking the difference with the tools listed seems like a better approach, since hashes dont give that much insight – filip Apr 11 '20 at 12:54
2

Well, let's take for example a Google Play Store app. You can download an .APK from the Google PlayStore (there is an extra website which does that for you).

After downloading the .APK file you can hash it with md5. Also, you should get the hash from the open source .APK file, which you have to build yourself. Now you have to compare those two hashes, if they match, it's the same code.

But be aware that a published app on the PlayStore may contain other informations like API keys etc. Which would change the hash and thus not having the same hash. Same goes for different Android Version the app is built on. Key is to build the app the same way it was published.

Disclaimer: this is just me thinking how it should work, in practice there can go a lot of things wrong, just a tiny bit of the app has to be different, and the hash will be different.

Not the answer you're looking for? Browse other questions tagged or ask your own question.