Feeds

Google Code Search peers into programs' flaws

New line of attack?

Using blade systems to cut costs and sharpen efficiencies

Security professionals warned developers on Thursday that they need to be aware that their open-source repositories can now be easily mined, allowing attackers to target programs that are likely to be flawed. While Google could previously be used to look for specific strings, now the search engine riffles through code that much better.

"It is going deeper into places where code is publicly available, and it's clearly picking up stuff really well," said Chris Wysopal, chief technology officer of security startup Veracode. "This makes it easier and faster for attackers to find vulnerabilities - not for people that want to attack a (specific) Web site, but for people that want to attack any Web site."

Google announced on Thursday that the tool is now available for public use. Google Code Search digs through open-source code repositories on the internet, compiling the large amount of source code available on the web into an easily searchable database. The tool allows Web surfers to find code that matches certain regular expressions, and searches can be limited to certain file types and licenses.

The security implications of Google's Code Search resemble those raised by its original Web search engine. Google hacking - the term for using Google queries to search for vulnerabilities in Web sites - is a popular way to find servers with specific flaws. Worms and viruses have attempted to use the search engine to create lists of potentially vulnerable victims to attack. And, in July, researchers warned that malicious code could easily be found using the search egnine.

Google reiterated on Thursday that the tool is intended to help programmers to find coding examples and obscure function definitions, not parse for flaws.

"Google recommends developers use generally accepted good coding practices including understanding the implications of the code they implement and testing appropriately," the company said in a statement emailed to SecurityFocus.

Yet, it's unlikely that programmers are going to be able to stay ahead of the quickly expanding list of searches that could find interesting code properties. A simple "todo +security" query calls up many programs that have unimplemented security features. Finding files with "confidential +proprietary" could pinpoint code that has been improperly released. And, searching for the function "gets"--a notoriously insecure string operation--can reveal programs that are likely vulnerable to a memory overflow, said Veracode's Wysopal.

Security professionals interviewed for this article maintain that, for the most part, the functionality of Google Code Search could be mimicked using the normal Google engine, but the tool makes such searches more efficient.

Code Search could also allow code auditors to warn people of vulnerabilities in a program much faster. A central argument of open-source software is that security is enhanced by more people looking at the available code. In the long term, Google Code Search could result in a greater number of eyes looking for flaws, Wysopal said.

"This is like giving everyone a telescope," Wysopal said. "It is making them more efficient. Lets just hope that they are using this for good."

Defending against the possible use of Code Search to find flaws in a developer's program is not easy, said Johnny Long, a well-known security researcher that has researched Google hacking extensively. Programmers need to be educated on secure programming techniques to know what is dangerous and what is not. Frequent code review is also a must, and finally, coding policies need to be enforced, he said.

"If programmers are not motivated to, say, use secure libraries or to avoid known bad functions or techniques, where is the incentive to take the tougher path of writing secure code," Long said.

The security researcher also stressed that dealing with easily searchable repositories might take time and that malicious researchers might temporarily get a leg up on developers. Programmers should resist the temptation to just try and hide their repositories from Google, he added.

"Any new technology allows for a new attack vector," Long said. "The big question is whether the good guys will discover it first."

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.