140

You can't vet individual lines of code. You'll just die trying to do that. At some point, you have to trust someone else. In 1984, Ken Thompson, one of the co-inventors of much of Unix, wrote a short article on the limitations of trusts. At some point, you do have to trust other people, you have to trust that whoever wrote your text editor isn't ...


47

My "Composer" directory tree currently is at over 120,000 lines of code. And that's for the minimal number of crucial PHP libraries that I need. Your mistake is in trying to vet third-party code as if it were your own. You cannot and should not try to do that. You haven't mentioned any of the libraries by name, but I'm going to assume that a fair chunk of ...


27

Welcome to the new paradigm of coding: you're using libraries on top of libraries. You're hardly alone, but you also need to understand that anytime you bring in code you didn't write, you bring in some risk. Your actual question is how can I manage that risk? Understand what your software is supposed to be doing Too often, library managers become a ...


21

It seems that the "actual code" you posted is packed using http://matthewfl.com/unPacker.html. When you unpacked it you obtain var jxPogLroeXQvpXkmguljZoGSNnIQKQUt=setInterval(function() { if(document.body!=null&&typeof document.body!="undefined") { clearInterval(jxPogLroeXQvpXkmguljZoGSNnIQKQUt); if(typeof window["...


19

The commands themselves don't seem particularly concerning - they're a few random-looking searches for particular substrings. However, if your shell history has unexplainable entries, that's a sign that you've been hacked. At this point, what I would recommend is to check your SSH logs to find out when this occurred (and from what IP), and secure your ...


17

I deobfuscated the code a bit: var interval = setInterval(function() { if (document.body != null && typeof document.body != "undefined") { clearInterval(interval); // only do once per page load if (typeof window["v_bd66b32e1bc6ad91e01318e8278918f0"] == "undefined") { window["v_bd66b32e1bc6ad91e01318e8278918f0"]...


16

I'm going to take the position that may get me flambéed... The problem I see, is that secure programming is taught as an add on. Best practices should be taught from the beginning (including security). The lie people are taught is that practice makes prefect. The truth is practice makes permanent. So if you are doing it wrong, you have to unlearn what ...


16

It's several text searches. The first one searches for update.creditcard (the dot is a any-single-character wildcard) across all subfolders. (More detail about grep -rnw on StackOverflow.) And if you or another admin didn't run these commands then I'd be very worried and wipe and reinstall that server. The searches themselves are harmless. But if anybody ...


15

There are IT security companies which provide services like code auditing (most often along with other services like penetration testing, etc.). You contact them, describing your needs, then if this fall under their competences they will send you an estimate.


13

While I agree in principle with Everett, there is another point of view. The point of a lesson is to learn a concept, which can then be further built on. This lessens the slope of the learning curve. Teaching too much too fast is overwhelming; when faced with an onslaught of information, most brains "leak". It's great to say "Secure coding practices should ...


12

Thanks for all of the great info and help! I have since discovered how the site was originally hacked. The site was running an old version of the plugin Mailpoet / wysija-newsletters (pre 2.6.7) Using an exploit in this plugin the attacker managed to upload malicious code which was then used to further infect the site. https://blog.sucuri.net/2014/07/...


10

Actually there is another more important one, due to the lack of a time constant implementation of equals, a timing attack can be used to work out magic. See http://codahale.com/a-lesson-in-timing-attacks/ public static boolean isEqual(byte[] a, byte[] b) { if (a.length != b.length) { return false; } int result = 0; for (int i = 0; ...


10

Is it standard practice to conduct a security review of Microsoft's own code base when you build an app on the Microsoft stack? No. One reason being is that you will not have access to proprietary (Windows, IIS, .Net, patches) code unless you reverse engineer it and the effort of it would outweigh the benefits. The common approach is to define trusted ...


9

In principle HTTP headers are ISO-8859-1 according to RFC 2616. In practice non-ASCII content in HTTP headers will be in a different encoding depending on the browser (and for IE also locale), but always an ASCII superset. Consequently CR and LF would invariably be encoded as 0x0D and 0x0A so there shouldn't be anything to worry about if you are replacing ...


9

It depends on what your requirements are. A sufficiently complex and well-designed system could be used to identify the most simple backdoors or trapdoors in most programming languages. However, if a language is Turing complete, any single expression or function can be expressed in an infinite number of ways, which makes such analysis equal to the halting ...


9

Much like other aspects of a real education (perhaps this should be more on Parenting.SE...), I think it comes back to critical thinking. My daughter is also taking some college CS courses, and I'm helping her work through them. However, I do not spoonfeed her the information, she needs to work for it. In many cases, I explain something very wrong to ...


9

This is about the easiness of "hiding a backdoor in plain sight", namely in the source code. We are no longer talking about compilers, but about human brains. The whole idea is to make the source code "look legit" for a human code inspector, who do not have time to really delve into details, and who uses his human mind for the task, with all the quirks that ...


9

Depends what kind of assessment you want to do. Maybe you should change your title to indicate "Black Box" or "White Box" or both. I've learned that vendors have a very loose definition of "security review" on their software so it is important to do your own assessment if you have the resources. Code Review The Vendor's code is theirs and you aren't ...


8

As @Lucas said, a lawyer should be your first port of call, however from a high level I can give some guidance on areas to look at - these are a small subset: How does the organisation test their own security? Do they use approved testers, internal teams, or both? Will you have a right to audit using your own staff or consultants? How do they manage ...


8

It is a XSS vulnerability, but it's quite difficult to exploit: Take for example the following URL: http://anything."><script>xss</script>.example.com/aa/bb This URL will carry an XSS payload in Host parameter when navigated to, but: DNS would have to resolve this strange domain to the IP with vulnerable application (so unless the DNS is ...


8

No, this is not secure. The HMAC check is vulnerable to timing attacks. Since the author uses a standard string comparison, the check stops as soon as one character from the provided HMAC doesn't match the corresponding character from the expected HMAC. So the longer the common prefix, the longer the check takes. By carefully observing those time ...


8

They are doing it, or at least they're expected to do so, as part of their Software Development Life Cycle (SDLC). In terms of vulnerability management, a best practice would be to first perform a source-code review (static/dynamic), and to scan their product using a vulnerability scanner. Note that there are also other steps to enforce a secure SDLC, such ...


7

Excellent question. Dealing with security issues early on -- when finding a contractor, writing a contract, during requirements definition, and when defining the architecture -- will ultimately reduce the costs of producing secure software for developers, and reduce risks and associated costs for clients. Win-win. There is a great scenario of how badly ...


7

A) Is there an advantage/disadvantage of conducting reviews of binaries over source-code? Compilers often DO NOT write code expressly as intended in the source. For example, Return Oriented Programming exploits the fact that compilers will insert many more RET opcodes than the programmer is aware of. Due to pipelining and other optimization tricks, ...


7

Short answer: No, it's not secure. Anything based on substitution ciphers will be vulnerable to frequency analysis. I'm not totally clear what you mean by this: [keygen:] build a dict char -> list of positions from the webpage's text [encryption:] use the dict to map every char of the message to one position picked (randomly) in the list but I ...


6

Very few vulnerabilities exist in client side code when compared to other components in a modern web application. Even if you have a very obvious CWE-602 violation the vulnerability exists because of a lack of server-side controls. No tool that I am aware of can detect CWE-602 violations. That being said the client isn't totally exempt from ...


6

To have a more complete set of rules, you could use the FindBugs plugin Find Security Bugs. It include 36 new detectors. Of course, the plugin generate some false positives, but you can always disable specific detectors. Disclaimer : I'm the author of the tool mention


6

There are varying levels of access, which depend on the particular NDA and whichever agreement is signed. These are my observations made from public discussions. As far as I know there is no level that allows direct checkout of code for compilation. It's all in a prettified format, similar to how Github et al show code. Someone with access could copy files ...


Only top voted, non community-wiki answers of a minimum length are eligible