Static analysis is the examination of computer source code without executing it. Most commonly static analysis is used to find bugs or ensure conformance to coding guidelines. The classic example is a compiler which finds lexical, syntactic and even some semantic mistakes. A source code security ...

learn more… | top users | synonyms

0
votes
1answer
61 views

Sandbox environment for “php malware” analysis [closed]

I would like to know how can I analyse an obfuscated malware php code ? I heard about cuckoo sandbox, but it seems too overwhelming for this particular task. So I decided to run a Vagrant box, install ...
1
vote
2answers
84 views

What are main differences between Source Code Analysis vs Static Application Security Testing(SAST)?

Do these 2 terminologies refer to the same thing? https://www.owasp.org/index.php/Source_Code_Analysis_Tools http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#.NET Some of the ...
-2
votes
2answers
81 views

Why do static code analyzers cite CWE rather than CVE in their findings?

I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
4
votes
3answers
300 views

Static code review approach

My questions is related with static code analysis approach used by Veracode vs Fortify/AppScan. Veracode – Finds security flaws in application binaries and bytecode without requiring source ...
1
vote
2answers
144 views

Static code analysis strategies [closed]

Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case? For example: We know ...
0
votes
3answers
170 views

What are the pros and cons of using live CDs vs VMs for malware analysis?

I'm planning on doing some malware research for a research project, and I was wondering what would be a better option for keeping my system safe from viruses accidentally infecting it. I'm only ...
2
votes
0answers
605 views

AngularJS Static Analysis Tools [closed]

I am setting up a software security initiative at a small software company. Part of this is selecting a static analysis tool for early and automated detection of security vulnerabilities. Many ...
4
votes
1answer
88 views

can Veracode be taught to accept mitigations that it does not yet recognize

Veracode (http://www.veracode.com/) has certain parameter encoding libraries that it trusts. Others are labeled as flaws. If I'm satisfied with another method of parameter encoding that is meant to ...
-1
votes
1answer
358 views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
1
vote
0answers
56 views

DLL preloading attack - are IAT libraries affected too?

I'm about to distribute a dll library (there's also a linux version) to my users but I'm afraid of dll preloading attacks (i.e. someone substituting its malicious dll to get called by mine and gain ...
2
votes
1answer
118 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
1
vote
1answer
131 views

Which are open problems on policy-based access control system?

I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly ...
1
vote
1answer
563 views

Static analysis of Android applications using Androguard

I am building a project a part of which involves performing static analysis for Android applications. I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't ...
3
votes
1answer
589 views

How do I know if a font is malicious?

There are cases of fonts being used for exploiting vulnerabilities {for ex: ThreatPost, SecureList and F-Secure}. My question is if you ever get hands on such a font, how do you know that it is ...
9
votes
1answer
721 views

List of methods in iOS that have been deprecated for security reasons?

Is anybody on the nets keeping track of iOS methods that have been deprecated by Apple for security reasons? I have searched around but with no luck. Going through all the deprecated methods and ...
8
votes
2answers
226 views

What applicability does the Halting Problem have to infosec?

I was reading an infosec blog recently, and I was caught off guard by the following statement: Sure you can run up to date software and firewalls and that network appliance in your data center ...
21
votes
7answers
3k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and ...