Feeds

Veracode hunts for backdoors in outsourced code

Sniffing out malicious code

Protecting users from Firesheep and other Sidejacking attacks with SSL

On-demand application security testing firm Veracode has added detection for backdoors and malicious code to its services. The addition aims to tap into concerns about the integrity of code developed by outsourced contractors.

Veracode’s SecurityReview provides application code review as an online subscription-based service. Clients submit compiled binaries, which use Veracode models to look for security problems. Unlike conventional code review schemes, the service works without looking at the source code of applications.

The firm, which began trading last year after being spun out by Symantec from its @stake acquisition, is targeting independent software developers and financial sector firms with a service designed to improve the security quality of applications without the need to hand over precious bodily fluids intellectual property in the form of source code. The service is applicable whether a firm is developing applications internally, purchasing software or integrating code from partners.

As the complexity of modern software applications increases, with components assembled from reusable binary components (libraries), security problems are increasingly likely to slip through quality assurance procedures (assuming any are in place). Veracode's pitch is that its service allows clients to screen for problems at a fraction of the price of manual code review. Veracode’s SecurityReview identifies software flaws introduced through either coding errors or malicious intent using binary code and dynamic web analysis techniques. It competes with firms such as Fortify Software.

The addition of backdoor detection capability is designed to boost the appeal of the service, which remains primarily about identifying regular security bugs. The term "backdoor" covers a lot of potential "hidden threats". According to Veracode, backdoors fall into four categories, as follows:

  • Special Credential Backdoors – Involve the hard coding of logic and special credentials into program code. The functions are commonly inserted by developers for either customer support or for debugging. If discovered, attackers can use the short-cuts as a backdoor.
  • Hidden Functionality Backdoors – Routines that allow authentication procedures to be bypassed, sometimes the result of leftover debug code.
  • Rootkits – Functions that hide the presence of what may turn out to be a backdoor.
  • Unintended Network Activity – A common characteristic of backdoors where applications may be found to listen on undocumented ports, make outbound connections to establish a command and control channel, or leak sensitive information over the network via SMTP, HTTP, UDP, ICMP, or other protocols. Occasionally this may be an intended support feature, but it can carry security and privacy risks and therefore ought to be detected.

Automatic detection of software vulnerabilities or malicious code is something of a Holy Grail for the security industry. Simply submitting Windows Vista, for example, to analysis by Veracode’s SecurityReview is not going to unearth every potential security problem. Chris Wysopal, CTO of Veracode and former high profile member of hacker collective L0pht Heavy Industries, told El Reg: "This is no silver bullet. We are not suggesting firms throw away threat modeling, dynamic testing or other elements of their security development lifecycle.

"Our service provides visibility into code, allowing organisations who haven't looked for problems before to add security to their development lifecycle."

Conventional code reviews processes commonly involve inspecting source code. PGP, for example, bases its promises that its encryption software is free of backdoors on the availability of its source code.

Veracode argues testing application binaries is effective as a security validation technique because binary (compiled code) represents the actual attack surface for the hacker. However, it also states that backdoors inserted in open source software might be detected in a matter of weeks whereas backdoors in commercial "closed source" applications might remain undetected for years, a factor that suggests the publication of source code improves security.

However, source code-only analysis runs into problems in the world of proprietary software, because even if you have access to the secret sauce you might not have access to the code of third-party libraries. Veracode claims a lack of access to source code doesn't hamper its efforts.

"Our service provides the same accuracy rates as source code tools. Even source code going through translation," Wysopal said. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.