Feeds

Google Code Search peers into programs' flaws

New line of attack?

Beginner's guide to SSL certificates

Security professionals warned developers on Thursday that they need to be aware that their open-source repositories can now be easily mined, allowing attackers to target programs that are likely to be flawed. While Google could previously be used to look for specific strings, now the search engine riffles through code that much better.

"It is going deeper into places where code is publicly available, and it's clearly picking up stuff really well," said Chris Wysopal, chief technology officer of security startup Veracode. "This makes it easier and faster for attackers to find vulnerabilities - not for people that want to attack a (specific) Web site, but for people that want to attack any Web site."

Google announced on Thursday that the tool is now available for public use. Google Code Search digs through open-source code repositories on the internet, compiling the large amount of source code available on the web into an easily searchable database. The tool allows Web surfers to find code that matches certain regular expressions, and searches can be limited to certain file types and licenses.

The security implications of Google's Code Search resemble those raised by its original Web search engine. Google hacking - the term for using Google queries to search for vulnerabilities in Web sites - is a popular way to find servers with specific flaws. Worms and viruses have attempted to use the search engine to create lists of potentially vulnerable victims to attack. And, in July, researchers warned that malicious code could easily be found using the search egnine.

Google reiterated on Thursday that the tool is intended to help programmers to find coding examples and obscure function definitions, not parse for flaws.

"Google recommends developers use generally accepted good coding practices including understanding the implications of the code they implement and testing appropriately," the company said in a statement emailed to SecurityFocus.

Yet, it's unlikely that programmers are going to be able to stay ahead of the quickly expanding list of searches that could find interesting code properties. A simple "todo +security" query calls up many programs that have unimplemented security features. Finding files with "confidential +proprietary" could pinpoint code that has been improperly released. And, searching for the function "gets"--a notoriously insecure string operation--can reveal programs that are likely vulnerable to a memory overflow, said Veracode's Wysopal.

Security professionals interviewed for this article maintain that, for the most part, the functionality of Google Code Search could be mimicked using the normal Google engine, but the tool makes such searches more efficient.

Code Search could also allow code auditors to warn people of vulnerabilities in a program much faster. A central argument of open-source software is that security is enhanced by more people looking at the available code. In the long term, Google Code Search could result in a greater number of eyes looking for flaws, Wysopal said.

"This is like giving everyone a telescope," Wysopal said. "It is making them more efficient. Lets just hope that they are using this for good."

Defending against the possible use of Code Search to find flaws in a developer's program is not easy, said Johnny Long, a well-known security researcher that has researched Google hacking extensively. Programmers need to be educated on secure programming techniques to know what is dangerous and what is not. Frequent code review is also a must, and finally, coding policies need to be enforced, he said.

"If programmers are not motivated to, say, use secure libraries or to avoid known bad functions or techniques, where is the incentive to take the tougher path of writing secure code," Long said.

The security researcher also stressed that dealing with easily searchable repositories might take time and that malicious researchers might temporarily get a leg up on developers. Programmers should resist the temptation to just try and hide their repositories from Google, he added.

"Any new technology allows for a new attack vector," Long said. "The big question is whether the good guys will discover it first."

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.