Developers update their software, sometimes they patch vulnerabilities.
Is it realistically possible to analyze the updated code (even if it's closed source) to find the vulnerability that has been fixed (and still exist on all unpatched versions)?
-
There's a specific tool for this (at least for binaries). It's called BinDiff. For managed applications with more metadata, it's generally pretty easy to write a tool to highlight the differences (unless they are obfuscated with an obfuscator that generates different code for each run).– Margaret BloomJan 21 at 10:15
Add a comment
|
3 Answers
Is it realistically possible ...
Yes. And it is also done in practice for many years. The term "1day exploit" (on contrast to 0day) is sometimes used in this context when the attacker manages to exploit a vulnerability after the patch was released but before it got installed - often by reverse engineering what vulnerability the patch has fixed.
From a few searches on the internet:
- From 2022: Patch these vulnerable VMware products or remove them from your network, CISA warns federal agencies: "Malicious cyber actors were able to reverse engineer the vendor updates to develop an exploit within 48 hours and quickly began exploiting these disclosed vulnerabilities in unpatched devices," CISA said.
- Reverse engineering and exploiting a vulnerability in Chrome 2019: A window of opportunity: exploiting a Chrome 1day vulnerability
- From 2016: Joomla Website Attacks Increase as Hackers Reverse Engineer Patches
- Reverse engineering a Windows patch 2011: Hackers could reverse-engineer Microsoft patches to create DoS attacks: A security company has demonstrated how to reverse-engineer a Microsoft patch in order to launch a denial-of-service attack on Windows DNS Server.
- Academic paper from 2008: Automatic Patch-Based Exploit Generation is Possible: Techniques and Implication
- Reverse engineering a vulnerability in Internet Explorer by comparing the fixed and the vulnerable version (2005): Reverse engineering patches making disclosure a moot choice?. This also provides some details about the tools used.
answered Jan 21 at 15:20
Is it possible at all? Generally yes, almost everything can be reverse-engineered, with difficulty varying with both the ecosystem and any obfuscating measures done by the developer. For example, for .NET application, it is much easier than for plain C binaries.
Is it realistic: Depends on what threat actors and which ecosystem we are talking about. In most cases, it is not very realistic. If we consider nation-state actors like intelligence agencies then it is realistic. Whether they actually want to spend effort on something that has a fix available is another story. Un-obfuscated .NET binaries (or similar) are also on the more realistic side, depending on the financial advantage an attacker expects from it (again considering a fix is available)
For database there is also the option of schema data comparisons tools, these could be used to compare environments & make sure there isn't anything unexpected missing in the change scripts - could also generate the change scripts.
I don't think you'll find a fail-safe mechanism.
I recommend that, when possible, you take into account compatibility with the current published source.
-
I personally think that OP asked a rather more general question about ALL kinds of software, hence you didn't quite answer the question at hand imho Jan 21 at 14:34
-
Use best of understanding when it comes to vote (in either direction). Specially when opportunity given to review question/answer (regardless of religion, faith, culture, believes, habits and so on. These questions/answers or comments are purely for the people, by the people. Jan 21 at 15:36
-
I don't see your point. I commented on how you went into a niche in a general question. I didn't upvote and neither did I downvote. Jan 21 at 17:48