116

It depends on what is meant by "secure source code analysis." One can do anything one pleases. The issue, I presume, is when someone else has asked for something called "secure source code analysis," and one wonders why one is not qualified for it. In many cases, such analysis must be done by a Subject Matter Expert (SME). In the final product, a SME ...


27

I think you need to be a good programmer to be successful, so I'd recommend becoming one. There may be lots of things that your toolkit / scanner misses. I honestly don't recommend relying completely on tools scan your code for you, as exploits change constantly, and someone may have coded in a way where the scanner can't detect the vulnerabilities. The ...


15

You can know if a font is dangerous by the following method: Install a system in a virtual machine. Shutdown it. From the "outside" (i.e. another OS), access the virtual disk for the VM, and compute a hash value for every single file. Restart the VM. In the VM, open the font. Then shutdown the VM again. From the outside, recompute the hash values for every ...


14

It's doubtful that a security expert would be effective at performing source code analysis without also being a skilled programmer. Many vulnerabilities are the result of technical or syntactical coding practices that are misused in some minor way. A missing semi-colon, an equal sign instead of a double-equals, an array boundary that is doubly defined on day ...


13

The Python manual comes with a warning about the pickle module: Warning The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source. This warning should be taken very seriously. If you unpickle untrusted data, an attacker will be able to exectue arbitrary code ...


12

It depends on your expectations. Security vulnerabilities caused by design problems (i.e. missing CSRF protection, only rudimentary implementation of a protocol etc) can probably be found if the tester has a deep knowledge of security concepts, even if (s)he is only able to follow the code flow without having a deeper knowledge of the specific programming ...


8

They are doing it, or at least they're expected to do so, as part of their Software Development Life Cycle (SDLC). In terms of vulnerability management, a best practice would be to first perform a source-code review (static/dynamic), and to scan their product using a vulnerability scanner. Note that there are also other steps to enforce a secure SDLC, such ...


7

A) Is there an advantage/disadvantage of conducting reviews of binaries over source-code? Compilers often DO NOT write code expressly as intended in the source. For example, Return Oriented Programming exploits the fact that compilers will insert many more RET opcodes than the programmer is aware of. Due to pipelining and other optimization tricks, ...


6

I'm assuming here that what you want to do is perform static analysis for the purpose of identifying security issues in the code bases you've been provided? If that's the case there's a number of approaches you can take. Assuming that the people who are doing the reviews are not skilled application security analysts, you're going to need to rely on tools ...


6

Nothing is ever impossible. But SQL injection vulnerabilities have gone down with ORMs and query builders which prevent the most common mistakes. In my experience, applications which use a secure(ish) by default template engine also have fewer XSS issues. But the main problems are: Input sanitation will never solve all issues as you can't sanitize the ...


5

One could write books about these things and not ever be satisfied. Let me try to answer this in general, without naming special products. Binary/Bytecode Analysis Advantages (mostly) Programming language agnostic Can be run on closed source binaries/libraries you got from wherever Can find flaws introduced due to compiler bugs (or undefined behaviour of ...


4

Often, people use these interchangeably within the security industry. The lists you are pointing to are referring to the same types of tools/assessment, with the addition that the second list is broader, including static analysis tools that are not targeted at security, such as those used to check for code quality issues. Some types of SAST technically do ...


4

As far as memory related issues go, there are still issues e.g. you can still stumble upon a null pointer, use an out of bounds collection index, accidentally share mutable data with other classes, make the application use all its allocated memory, or in some cases where almost all the memory is used and a lot of new temporary objects are created, the GC can ...


4

I am afraid there are more ways to obfuscate an URL than one can count. It's very easy to come with another method when your last one got flagged, so static analysis is not recommended. If possible, run the app inside an emulator, log all external communication and compare with a whitelist of allowed sites. Static analysis will generate too much false-...


3

Whilst it's fair to say that managed languages are less prone to certain classes of issue whem compared to languages like c/c++ there's still several classes of software bug which can apply to Java/Scala and other languages that run in managed environments. This can vary from input validation issues like SQL injection and cross-site scripting to error ...


3

Not only does secure code review require knowledge of the high level language, but also of the compiler options and HOW THE CODE ACTUALLY WILL WORK ON THE CPU! High level languages are efficient to write code in because they hide a lot of the complexity. But many errors and bugs hide within the complexity. As pointed out in another answer, compilers try ...


3

Does one need to be a good programmer to perform secure source code analysis? No. Will he be able to perform secure code review without knowledge of multiple programming languages and mastery over them? No. There's more to programming than expertise in the details of how various languages work. It's one of the things you need to be a good programmer, ...


3

Is there any way we can safely load a pickle? You've asked for any way, but it partly depends not only on the way, but on the pickle in question and on what you mean by "safely." Unless you mean something like "reasonably safely, given that I'll always know the provenance of the pickle," the answer is probably "no." However, here are some questions to ...


2

This has been covered before, but in my opinion, the best way to help developers find flaws that could lead to exploitation is to teach them to exploit code, teach them how to execute an SQL Injection attack or a direct object reference attack. Set up a capture-the-flag competition in-house with developers using their new hacking skills to break the sort of ...


2

I was wondering what would be a better option for keeping my system safe from viruses accidentally infecting it. I'm only planning on analyzing the binaries, not running them To summarize the simple answer: Get a hex editor or whatever other tools you plan to use on an ARM-based NON-Windows smartphone or tablet to analyze Windows x86 binary malware. The ...


2

The main two things that come to mind are the threats that can compromise you when using them. In both cases, the threats are fairly rare. For a VM, the main threat to your system is a virus that is able to exploit the hypervisor. Such a virus would be able to escape the VM and infect your system. VMs also have the benefit of being able to do a closer ...


2

Codacy (an automated code review platform) has been deploying Scala security patterns. There's a blog post with the first 9 patterns and if you head to the patterns list in the documentation you can filter for security to check the other ones out (more will be coming out soon). The way Codacy works is you log into the platform, point it to your git ...


2

The short answer is use them both. Hybrid or Integrated Application Security Testing (IAST) combines Dynamic Application Security Testing (DAST) of binaries and byte-code with Static Application Security Testing (SAST) to create a unified view of an application’s vulnerabilities. The goal is not just to find vulnerabilities but also help developers quickly ...


2

In addition to ack_'s answer, there is a significant learning curve to using these tools. As a penetration tester myself the time spent weeding out false positives and non-exploitable vulnerabilities often takes just as much (if not more) time as trying to leverage an attack. Add to that the time it takes to become proficient at using these tools and you ...


2

JAD has been unmaintained for a while now. For decompiling a jar, I typically use JD-GUI, just as your linked question proposes.


2

Ok, so trust is relocated from the component to the proof checker. On what basis can the proof checker's certificate process be trusted? The proof checker's certification process can be trusted because: the proof checker defines the safety policy; the proof checker employs its axioms to validate the safety predicate, and so knows whether the safety ...


2

You can use subresource integrity. This prevents an attacker from altering scripts. It adds a hash to the script tag, and if that hash does not match with the script it does not get executed.


2

Full disclosure: the following guide was written by the research team of Checkmarx, creator of CxSAST (static code analysis tool), where I am employed. Here is a JavaScript Secure Coding Practices guide: GitHub - https://github.com/Checkmarx/JS-SCP GitBooks - https://checkmarx.gitbooks.io/js-scp/ Since JavaScript is used these days both in front and back ...


2

Don't download it on a regular machine, as various services may try to access it for indexing or for previewing, which can be exploitable. But regardless, how advanced do you expect the malicious PDF to be? Who is your adversary? The answer to that will determine whether or not the answer is just to copy it with your AV enabled, or if you need to do it on a ...


2

You could take OWASP ASVS as a baseline. It provides quite comprehensive coverage of software checks broken down into next categories: Architecture Authentication Session Management Access Control Input validation and output encoding Cryptography Error Handling Data Protection Communications Malicious Code Business Logic Flaws Files and Resources Mobile API ...


Only top voted, non community-wiki answers of a minimum length are eligible