Hacker News Reader

Comment by m0xte | Hacker News Reader

Yes indeed. I'm not buying it isn't patched in some way before it's pushed to any app stores. Especially with all the noise beforehand about how it operates and the involvement of GCHQ/NCSC in development.

Edit: some digging. NHSX is run by Matthew Gould. Former Israel diplomat and tied via UK-Israel technology hub to NICE (Neptune Intelligence Computer Engineering) Ltd which is a former Israeli army surveillance and data security company among other functions.

So basically a hotpot of reasons not to install this thing.

View on HN

A security researcher in Twitter was looking into it the other day, and found the app isn't obfuscated (they were able to decompile it "cleanly").

I'm not saying that guarantees no skullduggery is afoot, but it goes a long way - at least in it's current form, at that point in time.

That's good to know.

It's the same story as with Signal for iOS. How do we know the version downloaded from the App Store is the same code hosted on GitHub? I'd like to have the option to sideload it. Clearly that would involve some work on their backend, but I think that's fairer than the stuff described in this Signal GitHub issue [0] and Telegram's website [1] regarding the same thing.

EDIT: if I'm wrong please leave some details for myself and others to learn more. I've worked on iOS apps for several years, and as far as I know there's no way to verify if an app downloaded from the App Store was compiled from a particular code revision. Even the same code compiled on separate machines can produce different unique binary IDs. And on the scale of difficulty, I'd say that sideloading is less difficult than jailbreaking, if that method even really works for this problem.

[0]: https://github.com/signalapp/Signal-iOS/issues/641

[1]: https://core.telegram.org/reproducible-builds#reproducible-b...

Yes exactly that. I imagine vendor signing causes some issues there as well.

It's not possible to side-load iOS apps and still get push notifications. Also, Apple doesn't allow you to distribute applications outside of the app store (unless you violate the terms of your enterprise developer account).

While I'm not an expert on push notifications, shouldn't you be able to receive push notifications if you entitle your application for them and create the right certificate online?

This is my understanding. You would have to register your device in ADP and create an ad-hoc certificate for the app. If people are doing this on their own ADP accounts, then they're just testing their own builds, not receiving an enterprise deployment from some single developer.

Apple does allow self-hosting enterprise apps, one of the main distribution methods for in-house apps is buying a license from Apple to install your own certification on iOS and MacOS devices which will let you basically remotely install, update and sideload in-house applications.

We personally opted out of it because the user's device's security would ultimately fall into our hands and at worst we have a root kit on the user's device someone might exploit.

FWIW, in iOS 13 Apple has finally made it so you can firewall off user personal device control from MDM control https://www.brianmadden.com/opinion/Apple-iOS-13-user-enroll...

Well, can’t the vendor upload the binary that was signed by Apple’s private key? So all you’d have to do verify it would be to compile the source code to produce the exact same binary... assuming that the process can be made to be deterministic?

If you install from an App store and want to know if it matches the source, you need to pull the installed package from your phone and compare the contents to your own known good binaries.

Ideally, if the builds are fully repeatable, the only differences should be in the signatures, but of course, you need to confirm that the signature doesn't drive unexpected differences in behavior.

I don't have the skills or the tools to do this, but it's not like it's some impossible mystery.

In order to do what you’re suggesting you have to jailbreak a device, which I mentioned in my comment and is discussed in many blog posts such as [0], which links to others.

Without a jailbreak, which isn’t a sure thing and even if available is not nearly as feasible as sideloading, it in fact is an impossible mystery to decrypt an iOS app store build to inspect it.

[0]: https://ivrodriguez.com/reverse-engineer-ios-apps-ios-11-edi...

I wouldn't trust anything coming from Israel ever. Their government appears to have a mandate for installing backdoors, evidenced by the scrapped Iron Dome project which they wouldn't hand the source code over for.

https://news.ycombinator.com/item?id=22512674

You are doing a huge huge leap here, Iron Dome was not scrapped because of backdoors nor do we know about any (officially). Then one project doesn't mean that Israel are doing the same in other projects, and finally the mentioned company is private and has nothing to do with the government

I'm not making any leaps, I provided a link that explained it. I have no trust in Israel to begin with due to their uncomfortable control over US politics, this was just further evidence to support that decision.

Well, it should be fairly trivial to put it through the rigor of some MITM proxies and verify that the built app is not making any unexpected network requests. I look forward to infosec twitter ripping this apart.

That would be interesting analytics but you just never know with this stuff. Even basic intercept-avoiding technology like burst encoding require very long term sampling to detect, so the thing would need to be disassembled and every line of code analysed.

...is it not possible to build the app from source yourself?

I will install this app happily from F-Droid, and no other place.

Reply on news.ycombinator.com