Feeds

Google Code Search peers into programs' flaws

New line of attack?

Build a business case: developing custom apps

Security professionals warned developers on Thursday that they need to be aware that their open-source repositories can now be easily mined, allowing attackers to target programs that are likely to be flawed. While Google could previously be used to look for specific strings, now the search engine riffles through code that much better.

"It is going deeper into places where code is publicly available, and it's clearly picking up stuff really well," said Chris Wysopal, chief technology officer of security startup Veracode. "This makes it easier and faster for attackers to find vulnerabilities - not for people that want to attack a (specific) Web site, but for people that want to attack any Web site."

Google announced on Thursday that the tool is now available for public use. Google Code Search digs through open-source code repositories on the internet, compiling the large amount of source code available on the web into an easily searchable database. The tool allows Web surfers to find code that matches certain regular expressions, and searches can be limited to certain file types and licenses.

The security implications of Google's Code Search resemble those raised by its original Web search engine. Google hacking - the term for using Google queries to search for vulnerabilities in Web sites - is a popular way to find servers with specific flaws. Worms and viruses have attempted to use the search engine to create lists of potentially vulnerable victims to attack. And, in July, researchers warned that malicious code could easily be found using the search egnine.

Google reiterated on Thursday that the tool is intended to help programmers to find coding examples and obscure function definitions, not parse for flaws.

"Google recommends developers use generally accepted good coding practices including understanding the implications of the code they implement and testing appropriately," the company said in a statement emailed to SecurityFocus.

Yet, it's unlikely that programmers are going to be able to stay ahead of the quickly expanding list of searches that could find interesting code properties. A simple "todo +security" query calls up many programs that have unimplemented security features. Finding files with "confidential +proprietary" could pinpoint code that has been improperly released. And, searching for the function "gets"--a notoriously insecure string operation--can reveal programs that are likely vulnerable to a memory overflow, said Veracode's Wysopal.

Security professionals interviewed for this article maintain that, for the most part, the functionality of Google Code Search could be mimicked using the normal Google engine, but the tool makes such searches more efficient.

Code Search could also allow code auditors to warn people of vulnerabilities in a program much faster. A central argument of open-source software is that security is enhanced by more people looking at the available code. In the long term, Google Code Search could result in a greater number of eyes looking for flaws, Wysopal said.

"This is like giving everyone a telescope," Wysopal said. "It is making them more efficient. Lets just hope that they are using this for good."

Defending against the possible use of Code Search to find flaws in a developer's program is not easy, said Johnny Long, a well-known security researcher that has researched Google hacking extensively. Programmers need to be educated on secure programming techniques to know what is dangerous and what is not. Frequent code review is also a must, and finally, coding policies need to be enforced, he said.

"If programmers are not motivated to, say, use secure libraries or to avoid known bad functions or techniques, where is the incentive to take the tougher path of writing secure code," Long said.

The security researcher also stressed that dealing with easily searchable repositories might take time and that malicious researchers might temporarily get a leg up on developers. Programmers should resist the temptation to just try and hide their repositories from Google, he added.

"Any new technology allows for a new attack vector," Long said. "The big question is whether the good guys will discover it first."

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

The essential guide to IT transformation

More from The Register

next story
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.