6

I am interested to know what threats does it pose, if the source code of a security suite is leaked. It came to my mind after reading the following URLs:

http://www.pentestit.com/2011/01/31/source-code-kaspersky-antivirus/

http://forum.kaspersky.com/index.php?showtopic=199598

What would be the threat if the source code was up-to-date and how can one make sure that while using such product, the security is at its minimum risk (comparing with the situation in which no source code is leaked).

Improve this question

5 Answers 5

Reset to default
6

There is possibly a short term raised threat potential, as you can guarantee attackers will be trawling through the code to find weaknesses, however there will also be a number of white hats doing the same, as well as code review teams from organisations that use Kaspersky, so issues may well be found, but the end result is likely to be a more secure codebase than might otherwise have been the case.

Many eyes, and all that.

The relative risk is difficult to estimate though, because it is a high likelihood that attackers have already been reverse engineering and disecting AV code anyway - so in this case the addition of the good guys to the review pool could skey the risk downwards.

Improve this answer
1
  • 1
    Many people already had the source code prior to that and trade it among friends. These leaks often happen because someone is not careful with their stolen trees and accidentally or intentionally leak it.
    – forest
    Apr 5, 2018 at 2:01
4

Isn't this the age old question of whether open source reduces security or not? The popular theory among security practitioners at least is that if you are relying on your code not being accessed to provide security then all you have is security by obscurity. This is the reason that the only encryption algorithms that are trusted are where the code has been open and extensively analysed by large numbers of people over a number of years. Don't really see why security software in this case Kapensky should be any different.

That said I made the following point in my post on open source:

Even the OWASP risk rating methodology has ease of detection and ease of exploit as vulnerability factors which increase the overall risk. Companies have lots of mainframe code that I'm sure has plenty of security vulnerabilities, but when you calculate the risk score it has to be lower than a cross site scripting vulnerability existing in the latest open source CMS you just downloaded. Now you can take the view that this a dagger hanging over your head, its only a matter of time before someone finds it and exploits it (e.g. Stuxnet and SCADA). An alternate view is that with limited resources, building defence in depth security controls and keeping the source code confidential is a legitimate risk mitigation strategy.

Improve this answer
2
  • Hmmmm - my answer and yours may well be saying much the same thing... have a plus 1 :-)
    – Rory Alsop ♦
    May 4, 2011 at 14:35
  • @Rory-alsop Thanks! Agree with your point like the release of the SCADA vulnerabilities the only difference between before the code was released and after is that the researchers aka good guys can review it and find vulnerabilities for kaspersky to fix. Parallel could be Chromium and Firefox in Pwn2own vs Internet Explorer 8. The reduced vulnerabilities in IE9 is an example that even in closed code vulnerabilities can be reduced in if good SDL processes are followed
    – Rakkhi
    May 4, 2011 at 15:12
3

In all likelihood the effect will be minimal either way.

Certainly, if the security of your system critically depends on the secrecy of the code then this is a problem in itself. Don't forget there are tools to automatically produce source code from compiled images anyway, and there are also people who can decompile machine code to high level languages as quickly as they can write.

Improve this answer
3

I think the main risk faced in such events is a business risk: the company perceives its source code to be the asset that gives it an edge over its competitors, only now the competitors have equal access to that asset. Secondarily there's obviously damage to the company's reputation: a security company that can't even secure its own business processes?

Yes, there are also likely to be vulnerabilities that can be discovered easier with access to the source, but the principle damage is to the company. As others have indicated, finding a vulnerability is a power that can be used for both good and evil.

Improve this answer
2
  • 2
    +1, also, in many cases the actual source code is what damages the reputation - when you see how badly this company writes code, would you still want to buy their product? Also, a security company should have been following a complete SDLC, in which case the source code should have minimal defects - if that's not the case, the fact that you can determine that they did not have SDLC in place, is damaging enough, even besides the actual flaws.
    – AviD ♦
    May 5, 2011 at 12:47
  • @AviD good point, in fact the reputation damage is probably more real than the loss of competitive position.
    – user185
    May 5, 2011 at 14:35
2

One important point here... just because the source code is "leaked" doesn't mean it's comparable to Free/Open Source. If it was actually leaked (i.e. illegally disseminated and still covered by patents, copyright, NDAs, etc.), there's questionable-at-best legal ground for the good guys to audit it. In my opinion, once it's leaked, the owners/authors should at least legally agree not to prosecute/sue anyone who audits the now-public code.

I'm a sysadmin/developer, dealing almost exclusively with open source, and I spend quite a bit of my time neck-deep in the code we run. As to the Open Source question that's been raised here, we all know that attackers are busy pen testing and decompiling proprietary software. It makes sense to also allow the good guys to have a look. If for no other reason than I'd rather have everyone alerted about a vulnerability (in a hopefully responsible way) than just have the attackers know about it until the vendor decides to disclose.

Improve this answer
1
  • That's a very good point @Jason. In practice it does seem like leaked code does get reviewed and comments fed back to companies without litigation (I am not sure how official this is, but you hear about it a fair bit)
    – Rory Alsop ♦
    May 9, 2011 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .