MacOS – How to determine what an app does and if it contains malware

applicationsmacosterminal

How can we know on iOS and OS X what an Application really does?

On OS X you always can do the following: right click on an .app and "show package". Contents -> MacOS and double click the executable Unix file. Terminal opens and somehow tells you what the app does.

I don't know if you've heard but it seems somebody modified Xcode's compiler to add malware to apps. This modified compiler is as the media says widely spread in China so many apps are affected. So also as the media says a company has detected about 400 apps that seem to be infected.

My question now is, how you could tell what an app does on iOS? How to determine if it contains malware or something else harmful.

And is there another way to tell what apps do on OS X than starting the exacutable Unix file located in the app's package?

Best Answer

Short answer: you can't know

A bit longer answer: Simply running and using the application will not show you what might be going on behind the scenes. To dig into that, you'll need to run the application in a debugging environment to analye data and process flows, keep track of any subprocesses created, monitor any network communication initiated by the application etc. etc. As this is rather cumbersome and requires a lot of skills and experience, it usually comes down to trust at the end.