Feeds

Veracode hunts for backdoors in outsourced code

Sniffing out malicious code

The essential guide to IT transformation

On-demand application security testing firm Veracode has added detection for backdoors and malicious code to its services. The addition aims to tap into concerns about the integrity of code developed by outsourced contractors.

Veracode’s SecurityReview provides application code review as an online subscription-based service. Clients submit compiled binaries, which use Veracode models to look for security problems. Unlike conventional code review schemes, the service works without looking at the source code of applications.

The firm, which began trading last year after being spun out by Symantec from its @stake acquisition, is targeting independent software developers and financial sector firms with a service designed to improve the security quality of applications without the need to hand over precious bodily fluids intellectual property in the form of source code. The service is applicable whether a firm is developing applications internally, purchasing software or integrating code from partners.

As the complexity of modern software applications increases, with components assembled from reusable binary components (libraries), security problems are increasingly likely to slip through quality assurance procedures (assuming any are in place). Veracode's pitch is that its service allows clients to screen for problems at a fraction of the price of manual code review. Veracode’s SecurityReview identifies software flaws introduced through either coding errors or malicious intent using binary code and dynamic web analysis techniques. It competes with firms such as Fortify Software.

The addition of backdoor detection capability is designed to boost the appeal of the service, which remains primarily about identifying regular security bugs. The term "backdoor" covers a lot of potential "hidden threats". According to Veracode, backdoors fall into four categories, as follows:

  • Special Credential Backdoors – Involve the hard coding of logic and special credentials into program code. The functions are commonly inserted by developers for either customer support or for debugging. If discovered, attackers can use the short-cuts as a backdoor.
  • Hidden Functionality Backdoors – Routines that allow authentication procedures to be bypassed, sometimes the result of leftover debug code.
  • Rootkits – Functions that hide the presence of what may turn out to be a backdoor.
  • Unintended Network Activity – A common characteristic of backdoors where applications may be found to listen on undocumented ports, make outbound connections to establish a command and control channel, or leak sensitive information over the network via SMTP, HTTP, UDP, ICMP, or other protocols. Occasionally this may be an intended support feature, but it can carry security and privacy risks and therefore ought to be detected.

Automatic detection of software vulnerabilities or malicious code is something of a Holy Grail for the security industry. Simply submitting Windows Vista, for example, to analysis by Veracode’s SecurityReview is not going to unearth every potential security problem. Chris Wysopal, CTO of Veracode and former high profile member of hacker collective L0pht Heavy Industries, told El Reg: "This is no silver bullet. We are not suggesting firms throw away threat modeling, dynamic testing or other elements of their security development lifecycle.

"Our service provides visibility into code, allowing organisations who haven't looked for problems before to add security to their development lifecycle."

Conventional code reviews processes commonly involve inspecting source code. PGP, for example, bases its promises that its encryption software is free of backdoors on the availability of its source code.

Veracode argues testing application binaries is effective as a security validation technique because binary (compiled code) represents the actual attack surface for the hacker. However, it also states that backdoors inserted in open source software might be detected in a matter of weeks whereas backdoors in commercial "closed source" applications might remain undetected for years, a factor that suggests the publication of source code improves security.

However, source code-only analysis runs into problems in the world of proprietary software, because even if you have access to the secret sauce you might not have access to the code of third-party libraries. Veracode claims a lack of access to source code doesn't hamper its efforts.

"Our service provides the same accuracy rates as source code tools. Even source code going through translation," Wysopal said. ®

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?