How can we verify that the open-source code is deployed and actually in use?

Question

Many corona apps are developed in the moment, and some of them e.g. In Germany are open source.

Many people fear to be spied by this app. Im definitely Not one of them.

Still it raised the question in me:How can we make sure that the open source code is actually deployed without modifications?

On the client side that is easy, you just decompile the Apk.

But what about the server code?

In theory I could make changes to the opesource code before deploying it and nobody would know?

Are there mechanisms out there to ensure that?

Answer 1

Not only can you not verify that the code is running unmodified, you cannot verify that there is any code running at all: perhaps the entire service is operated by a clever hacker tapping out electrical pulses into an Ethernet cable, and you'd have no way of knowing.

Okay, so maybe you could tell (for one, such a hacker would have to sleep eventually -- but if there were two hackers...), but the larger point here is that a service is always completely opaque to its users. Any code-verification methods afforded by the service are also part of the service and could therefore lie, undetectably, to users.

Two solutions (or, really, workarounds) to this issue:

1. Since the code is available, you can run your own instance of the service. Since you are the operator of the service, you know firsthand what code is running and do not have the verification problem that users of the service do.

2. A service may be architected such that a client never sends any sensitive data to the service. This is considered under the field of secure multi-party computation, which Wikipedia defines as:

   a subfield of cryptography with the goal of creating methods for parties to jointly compute a function over their inputs while keeping those inputs private

   In other words, you may encrypt or transform data on the client in such a way that the service can operate on submitted data but not understand its substance. (Related concepts include homomorphic encryption, zero-knowledge proofs, and oblivious transfer.) One such simple service is Clipperz, a password manager that holds a user's encrypted passwords and never exposes the unencrypted data to the server. We do not know if the service is authentic, but we limit the worst case of what an evil service can possibly do.

   This relies on trustworthy client participation in the scheme, but clients are actually verifiable, unlike services. (Client verification may not be easy but is at least informatically possible.)

Answer 2

The idea of the Corona Apps data protection feature is, that your data does not leave the mobile unless you upload it in case of a positive test. This is good insofar as the integrity of a server application is less relevant and would be hard to proof by users.

So in order for you (or somebody doing that as a public service) to verify that the critical client app (on the app stores) actually reflects the open source code you would have to compare the binaries with a self build binary. This is tedious since you need the exact same buildchain and you might need to account for differences in things like hostnames, timestamps and random file ordering.

There is a whole movement around reproducible/deterministic and verifiable builds which would make that easier, but I don't think that was part of the requirements (and is not so common for mobile apps).

Another option is to actually analyze the network traffic of the app. This can however be hard depending on the encryption and is not entirely reliable as there can be hard to find side channels or the app can decide to wait with unauthorized transfers till a certain time/signal.

So generally I expect people will try to poke holes and they could discover malicious builds, but there is no guarantee. Especially not since it also depends on the vendor provided Bluetooth tracking API.

However, I would think the risk (for example for the German App) is small, SAP, Telekom or Government has all to lose and nothing to gain from a backdoor in the covid app.