How can Data security be ensured in an open source software?

Question

In open source projects handling user data in a secure manner can be managed, for example through encryption and password protected functionality. What I'd like to create is a way for the user to publish content, which can be read by other users, but not manipulated.

In case a program has some safeguards against tempering with user data, but is open source, there is the possibility for anyone with access to the source code to create a custom version of it without the safeguards. As a result a modified version of the code can be used maliciously.

I thought of a way to compare a checksum (generated by the published source code) with an internal checksum shipped with the program binary. Unfortunately this still can be bypassed the same way I was describing above; It seems I am thinking inside the box here.

An example scenario of what I'd like to avoid is:

User A receives content from user B; modify it, and then send it to user C, pretending that user B made the modified content.

This can be done easily if user A has an unsecure modified version of the program.

Is there any way data of an open-source software can be protected from the usage of malicious versions like this?

Answer 1

I think verifying the integrity of the content shouldn't be tied to the program it was made with, but to the person who made it instead. The standard way to verify this is via cryptographic signatures, for example PGP. The idea is that the person who makes the content signs it with their private key, who nobody else has access to. The integrity of the signed file can be verified with the person's public key which can be distributed via the servers used by your app (for example).

You can integrate the functionality in your app, so it'd reject any files that don't have valid signatures. That means that there can be tampered versions of the software that bypass those checks, but illegitimate files can only be used in the tampered program.

Answer 2

There is the possibility for anyone to tamper with the source code of Linux and to release a clone of, say, Debian, but filled with keyloggers and other spyware. Once such tampered version is released, two things will happen:

1. Some persons will be mislead into installing this tampered version of Debian.
2. Most persons will still download Debian distributions from the trusted sources, such as the official Debian website.
3. Someone will notice the existence of the tampered version, and articles would appear, alerting everyone about this particular clone of Debian. Eventually, legal actions would bring down the site distributing the clone.

You're in the exact same situation:

1. Make sure the users know that the binary you distribute is the correct one. If it's an Android app, it should be clear for anyone that yours is the official one. If it's a desktop application someone downloads from a website, ensure your website looks professional enough.
2. Clearly state in the application what exact measures are taken to protect the personal data of your users. If the clone keeps this information intact, while removing the safeguards, it is explicitly misleading the users, which would help with the legal action.
3. Monitor the activity around your application. If a clone without the safeguards is released, you have to be the first to know about it.

Answer 3

There are several distinct ways in which this issue is handled now:

• Many source-code packages are hosted at version-control repositories such as GitHub, which is thought to be a trustworthy place to obtain them. The git version-control system itself then assists in assuring source-code integrity.

• Where, say, a .zip or .gz file can be independently downloaded, a sha1 "signature" is provided on the same web-site page which can be [manually ...] checked against the download.

• The package-management mechanisms of various Linux distributions all contain various cryptographically-based integrity checks, which prevent the introduction of unauthorized modifications.

• The "installer" systems for both Windows and the Mac – as well as for mobile devices – all include "registered developer" checks. These developers have each been issued public-key cryptographic keys by which they must "sign" their distributions ... as well as every executable file which is a part of it.

• Most modern operating systems also have further safeguards against the introduction – or execution, – of "un-signed material."

So – "the existing safeguards might not be perfect, but they're definitely out there already."

Answer 4

Remember that software acts not for itself, but as an agent of a person - either an individual or an organisation, who generally either owns or is given some control of the computer on which it runs.

Your question doesn't have enough detail to provide any specific security suggestions, but in general it's best to think about what capabilities each person should have in relation to things that affect others. Don't expect any copy of the software that acts for them to make those restrictions - instead software acting for and operated by others needs to enforce the restrictions.

In the case of a system with authors, a publisher, and readers, where you want to restrict the capabilities of authors, then the software operated by the publisher and/or the reader will enforce the restrictions.

Those others, for whose protection the restrictions exist, will probably not choose to use the malicious modified version of the software that you suggest might be created. You can warn them about it if you think they might be tricked into it, but if they choose to use it anyway then you as a software creator may not have a responsibility to protect them.