The Stack Overflow podcast is back! Listen to an interview with our new CEO.
116

It depends on what is meant by "secure source code analysis." One can do anything one pleases. The issue, I presume, is when someone else has asked for something called "secure source code analysis," and one wonders why one is not qualified for it. In many cases, such analysis must be done by a Subject Matter Expert (SME). In the final product, a SME ...


27

I think you need to be a good programmer to be successful, so I'd recommend becoming one. There may be lots of things that your toolkit / scanner misses. I honestly don't recommend relying completely on tools scan your code for you, as exploits change constantly, and someone may have coded in a way where the scanner can't detect the vulnerabilities. The ...


25

There's a couple of ways that I've seen this done, each has it's pros and cons. As noted by @RoryAlsop below a common point for both approaches is that the executive summary should, as much as possible, be written for a business audience (assuming that it's a test you're doing for a 3rd party or the report will be passed to management). Reporting by ...


16

Here are the things on my list, that I use for my clients (including some of those that you've mentioned): Coverage (according to what the org requires today, and expects to use in the future) Language Architecture (e.g. some tools are great for web apps, but not so much for rich clients or even Windows Services / daemons) Framework (e.g. support for ASP....


14

It's doubtful that a security expert would be effective at performing source code analysis without also being a skilled programmer. Many vulnerabilities are the result of technical or syntactical coding practices that are misused in some minor way. A missing semi-colon, an equal sign instead of a double-equals, an array boundary that is doubly defined on day ...


12

Exciting question! Too often I feel that our industry strives for the latest and greatest fad in security. We go after the latest exploits, spend serious cash on the latest tools and blame layer 8 for the gaps. I know that is a gross generalization, but I wanted to underscore the importance of this topic -- Reporting! I have my opinions as to what should be ...


12

It depends on your expectations. Security vulnerabilities caused by design problems (i.e. missing CSRF protection, only rudimentary implementation of a protocol etc) can probably be found if the tester has a deep knowledge of security concepts, even if (s)he is only able to follow the code flow without having a deeper knowledge of the specific programming ...


10

You can know if a font is dangerous by the following method: Install a system in a virtual machine. Shutdown it. From the "outside" (i.e. another OS), access the virtual disk for the VM, and compute a hash value for every single file. Restart the VM. In the VM, open the font. Then shutdown the VM again. From the outside, recompute the hash values for every ...


10

The Python manual comes with a warning about the pickle module: Warning The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source. This warning should be taken very seriously. If you unpickle untrusted data, an attacker will be able to exectue arbitrary code ...


8

They are doing it, or at least they're expected to do so, as part of their Software Development Life Cycle (SDLC). In terms of vulnerability management, a best practice would be to first perform a source-code review (static/dynamic), and to scan their product using a vulnerability scanner. Note that there are also other steps to enforce a secure SDLC, such ...


7

After a Penetration Test or Hybrid Application Analysis the resulting report is centered around the findings. There should be a high level overview that discusses the flaws and their collective impact on the system. A finding is any security violation. This includes any CWE violation, but the most common web application findings fall under the OWASP top ...


7

A) Is there an advantage/disadvantage of conducting reviews of binaries over source-code? Compilers often DO NOT write code expressly as intended in the source. For example, Return Oriented Programming exploits the fact that compilers will insert many more RET opcodes than the programmer is aware of. Due to pipelining and other optimization tricks, ...


6

I'm assuming here that what you want to do is perform static analysis for the purpose of identifying security issues in the code bases you've been provided? If that's the case there's a number of approaches you can take. Assuming that the people who are doing the reviews are not skilled application security analysts, you're going to need to rely on tools ...


6

Established expert... that would be me (although not under this name -- I use a pseudonym because I am tremendously humble). Allow me to answer, then. The "halting problem" is indeed an illustration of the impossibility to decide (for a computer) whether a given program will halt or not. Of course, a lot of programs are decidable, but not all of them. ...


6

Here is the most important thing to know about how to evaluate a static analysis tool: Try it on your own code. I'll repeat that again. Try it on your own code. You need to run a trial, where you use it to analyze some representative code of yours, and then you analyze its output. The reason is that static analysis tools vary significantly in ...


5

I think what Rook says it very true, though this is more about the core of report, rather than its structure, to be placed after the report format has been designed. Try the STAR model (Situation, Task, Action & Result): I have seen great reports written with this model under the hood. The great thing about it is that it can be used in almost all ...


5

One could write books about these things and not ever be satisfied. Let me try to answer this in general, without naming special products. Binary/Bytecode Analysis Advantages (mostly) Programming language agnostic Can be run on closed source binaries/libraries you got from wherever Can find flaws introduced due to compiler bugs (or undefined behaviour of ...


4

As far as memory related issues go, there are still issues e.g. you can still stumble upon a null pointer, use an out of bounds collection index, accidentally share mutable data with other classes, make the application use all its allocated memory, or in some cases where almost all the memory is used and a lot of new temporary objects are created, the GC can ...


4

I am afraid there are more ways to obfuscate an URL than one can count. It's very easy to come with another method when your last one got flagged, so static analysis is not recommended. If possible, run the app inside an emulator, log all external communication and compare with a whitelist of allowed sites. Static analysis will generate too much false-...


3

Often, people use these interchangeably within the security industry. The lists you are pointing to are referring to the same types of tools/assessment, with the addition that the second list is broader, including static analysis tools that are not targeted at security, such as those used to check for code quality issues. Some types of SAST technically do ...


3

In first: It's like writting a book, first line will keep reader or not. (The Intro is to write at least.) Something like intro, begin, content, end. Introduction Goals Refresh terms of contract. Description of targets Description of methods Execution Step by step: goal, action, reaction Observations -> questions furter operations, step by step New ...


3

I've never written a security audit report, though in my role I tend to receive them. The best one that we had looked over our whole product at specific areas in interest. The report was broken down into those areas. Overall the format was: Title Executive summary - a brief overview of the purpose and scope of the audit. And high level comments, on the ...


3

Whilst it's fair to say that managed languages are less prone to certain classes of issue whem compared to languages like c/c++ there's still several classes of software bug which can apply to Java/Scala and other languages that run in managed environments. This can vary from input validation issues like SQL injection and cross-site scripting to error ...


3

Not only does secure code review require knowledge of the high level language, but also of the compiler options and HOW THE CODE ACTUALLY WILL WORK ON THE CPU! High level languages are efficient to write code in because they hide a lot of the complexity. But many errors and bugs hide within the complexity. As pointed out in another answer, compilers try ...


3

Does one need to be a good programmer to perform secure source code analysis? No. Will he be able to perform secure code review without knowledge of multiple programming languages and mastery over them? No. There's more to programming than expertise in the details of how various languages work. It's one of the things you need to be a good programmer, ...


3

Is there any way we can safely load a pickle? You've asked for any way, but it partly depends not only on the way, but on the pickle in question and on what you mean by "safely." Unless you mean something like "reasonably safely, given that I'll always know the provenance of the pickle," the answer is probably "no." However, here are some questions to ...


2

A long list of criteria is as likely to distract you as help you come up with a good solution. Take, for example, the issue of "false positives". It's an inherent problem with such tools. The long term solution is learning how to live with them. It means that your coders are going to have to learn to code around the static analysis tool, learn what causes ...


2

This may be of some help. http://support.apple.com/kb/HT5567 I would think this information would be in the Security Update announcement.


2

This has been covered before, but in my opinion, the best way to help developers find flaws that could lead to exploitation is to teach them to exploit code, teach them how to execute an SQL Injection attack or a direct object reference attack. Set up a capture-the-flag competition in-house with developers using their new hacking skills to break the sort of ...


2

I was wondering what would be a better option for keeping my system safe from viruses accidentally infecting it. I'm only planning on analyzing the binaries, not running them To summarize the simple answer: Get a hex editor or whatever other tools you plan to use on an ARM-based NON-Windows smartphone or tablet to analyze Windows x86 binary malware. The ...


Only top voted, non community-wiki answers of a minimum length are eligible