1

How can we know on iOS and OS X what an Application really does?

On OS X you always can do the following: right click on an .app and "show package". Contents -> MacOS and double click the executable Unix file. Terminal opens and somehow tells you what the app does.

I don't know if you've heard but it seems somebody modified Xcode's compiler to add malware to apps. This modified compiler is as the media says widely spread in China so many apps are affected. So also as the media says a company has detected about 400 apps that seem to be infected.

My question now is, how you could tell what an app does on iOS? How to determine if it contains malware or something else harmful.

And is there another way to tell what apps do on OS X than starting the exacutable Unix file located in the app's package?

4
  • If the question is; can you detect or block if an application is sending your informations to an inappropriate service/serveur/hacker... You can check all your mac outgoing connections with obdev.at/products/littlesnitch/index.html
    – StrawHara
    Commented Sep 22, 2015 at 14:34
  • 1
    What do you mean 'Terminal opens and somehow tells you what the app does.'? When I do that I just get some random output from the app. Not necessarily what it "does" or purpose. Commented Sep 22, 2015 at 14:58
  • When porting programs with wine to OS X, it tells me which .dlls are missing or somethimes which frameworks it's accessing.
    – user148013
    Commented Sep 22, 2015 at 15:27
  • You've basically asked how to replace whole anti-virus industry with several mouse clicks. You can't. And no, running an executable in Terminal does not tell you what the app does. Commented Sep 22, 2015 at 15:40

3 Answers 3

3

Short answer: you can't know

A bit longer answer: Simply running and using the application will not show you what might be going on behind the scenes. To dig into that, you'll need to run the application in a debugging environment to analye data and process flows, keep track of any subprocesses created, monitor any network communication initiated by the application etc. etc. As this is rather cumbersome and requires a lot of skills and experience, it usually comes down to trust at the end.

2
  • So that is something you can do with a compiled app? Load it into Xcode and track in/output? Thought debug is only for non compiled code?
    – user148013
    Commented Sep 22, 2015 at 14:42
  • It's always on compiled code, it just gets synchronized with the source to make it easier for the developer to understand what is going on.
    – nohillside
    Commented Sep 22, 2015 at 14:46
1

You can't really determine what an app does short of trying to figure out what its byte code does. From a network perspective you can view all traffic in and out of your machine with something like LittleSnitch.

I'm not sure about checking other apps for malware but Apple has sent out an email with information on how to check if your version of Xcode contains malware. They recommend that you always download it from the Mac App Store or their developer website. If you must install it from somewhere else (USB drive) follow these steps.

To verify the identity of your copy of Xcode run the following command in Terminal on a system with Gatekeeper enabled:

spctl --assess --verbose /Applications/Xcode.app

where /Applications/ is the directory where Xcode is installed. This tool performs the same checks that Gatekeeper uses to validate the code signatures of applications. The tool can take up to several minutes to complete the assessment for Xcode.

The tool should return the following result for a version of Xcode downloaded from the Mac App Store:

/Applications/Xcode.app: accepted source=Mac App Store

and for a version downloaded from the Apple Developer web site, the result should read either

/Applications/Xcode.app: accepted source=Apple

or

/Applications/Xcode.app: accepted source=Apple System

Any result other than ‘accepted’ or any source other than ‘Mac App Store’, ‘Apple System’ or ‘Apple’ indicates that the application signature is not valid for Xcode. You should download a clean copy of Xcode and recompile your apps before submitting them for review.

1

On iOS

The problem with Xcode Ghost is the communication to another Server. So it would be possible to recognise this connection if you set up a proxy like asked in this question here and use Wireshark to see the connections. For HTTP-Connection also Charles should work. You also can see in Xcode in the Device Manager the Console-Log, which is closely the same as the Terminal-output of the Mac App. But Developers can hide information, they do not have to print every procedure in the terminal/console.

On OS X

There are some more ways to detect TCP/IP Traffic, manually via WireShare or use some Apps like (LitteSnitch, HandsOff, PrivateEye). HandsOff is the only App which also tracks file read/writes and many other things.

Conclusion

You have to trust the Developers and also hope they use the original Xcode from Apple. We have not enough (automated) tools to keep track of every function of an App.

1
  • @user3439894 Is there any reason for writing "developer" with a capital letter?
    – idmean
    Commented Sep 22, 2015 at 17:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .