0

Developers update their software, sometimes they patch vulnerabilities.

Is it realistically possible to analyze the updated code (even if it's closed source) to find the vulnerability that has been fixed (and still exist on all unpatched versions)?

1
  • There's a specific tool for this (at least for binaries). It's called BinDiff. For managed applications with more metadata, it's generally pretty easy to write a tool to highlight the differences (unless they are obfuscated with an obfuscator that generates different code for each run). Commented Jan 21, 2023 at 10:15

3 Answers 3

1

Is it realistically possible ...

Yes. And it is also done in practice for many years. The term "1day exploit" (on contrast to 0day) is sometimes used in this context when the attacker manages to exploit a vulnerability after the patch was released but before it got installed - often by reverse engineering what vulnerability the patch has fixed.

From a few searches on the internet:

0

Is it possible at all? Generally yes, almost everything can be reverse-engineered, with difficulty varying with both the ecosystem and any obfuscating measures done by the developer. For example, for .NET application, it is much easier than for plain C binaries.

Is it realistic: Depends on what threat actors and which ecosystem we are talking about. In most cases, it is not very realistic. If we consider nation-state actors like intelligence agencies then it is realistic. Whether they actually want to spend effort on something that has a fix available is another story. Un-obfuscated .NET binaries (or similar) are also on the more realistic side, depending on the financial advantage an attacker expects from it (again considering a fix is available)

0

For database there is also the option of schema data comparisons tools, these could be used to compare environments & make sure there isn't anything unexpected missing in the change scripts - could also generate the change scripts.

I don't think you'll find a fail-safe mechanism.

I recommend that, when possible, you take into account compatibility with the current published source.

3
  • I personally think that OP asked a rather more general question about ALL kinds of software, hence you didn't quite answer the question at hand imho Commented Jan 21, 2023 at 14:34
  • Use best of understanding when it comes to vote (in either direction). Specially when opportunity given to review question/answer (regardless of religion, faith, culture, believes, habits and so on. These questions/answers or comments are purely for the people, by the people.
    – Nadeem Taj
    Commented Jan 21, 2023 at 15:36
  • I don't see your point. I commented on how you went into a niche in a general question. I didn't upvote and neither did I downvote. Commented Jan 21, 2023 at 17:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .