What do you search for in Open Source code to be sure there isn't malicious code?

Question

I realize the answers will be language specific, but I am curious what terms you would look for when checking something out on Github? I was looking for a remote administration tool that I could use with clients, and found some awesome ones, that happen to be "viruses"

Take https://github.com/rsmudge/vncdll (associated with metasploit), or the QuasarRAT project for example: https://github.com/quasar/QuasarRAT

Now I have seen enterprise high priced tools like SolarWinds MSP Connect, Dameware, and so on that do most of those same things, but QuasarRAT is listed as a virus when I try compiling it.

I was playing with the idea of taking the QuasarRAT program apart, segmenting each feature into plugins, remove any that may be malicious only, but then I am not sure it still wouldn't be listed as a virus.

In PHP I would look for obfuscated code that was using base64_decode(), exec() and so on, but I am curious what terms I should be on the lookout for with C#, C++ C, Bash - specifically those that may involve keylogging, transmitting data to a remote host, or downloading additional things to the computer?

Things I can think of are TcpListener, AcceptTcpClient, stream, bind, sockets, http, wget, curl, ftp, ssh, rsync. Since I am not fluent in C++, C, and I know I have more to learn in Bash and C#, I would love suggestions for those fun Easter eggs that people have hidden that you have found.

While I realize that just because these terms are used, it doesn't mean it IS malicious, but at least I can focus some time on that function and decide what it is doing, what else is calling it, and if it is approved.

IF we can get a good list together, I will try to come up with a script that will automatically search and bring back the matches for review.

Answer 1

If you want to be 100% sure that some git repo doesn't contain malicious code, write it yourself; anything else will be an uphill battle.

If someone's really truly trying to hide malicious code in plain sight, then you probably won't notice it. Take for example, the infamous 2003 nearly-a-backdoor in the Linux kernel where this harmless code:

if ((options == (__WCLONE|__WALL)) && (current->uid == 0))
    retval = -EINVAL;

was turned into a backdoor like so:

if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
    retval = -EINVAL;

(hint: instead of checking if you're root uid == 0, it turns you into root uid = 0. So pass in the flags _WCLONE|_WALL to whatever system call this is and BAM! you're now root.)

This example isn't directly relevant, but shows that malicious code in C/C++ can be really subtle. So if you think there's a chance that someone is playing hide-and-seek games in the code, move on and find a different project.

---

I often deal with a softer version of your question, "Is this open source library / tool ok to use?". My approach is to see if it has a good reputation; is it actively maintained? Do their github tickets give the impression that they follow a proper dev process? Do they publish regular changelogs, including security fixes? Does it have unresolved CVEs against it? If there are binaries, are they properly code-signed?

It's not foolproof, but it weeds out seedier projects. (if anyone has a better way of vetting open source projects, I'd love suggestions!)