Feeds

Veracode hunts for backdoors in outsourced code

Sniffing out malicious code

Choosing a cloud hosting partner with confidence

On-demand application security testing firm Veracode has added detection for backdoors and malicious code to its services. The addition aims to tap into concerns about the integrity of code developed by outsourced contractors.

Veracode’s SecurityReview provides application code review as an online subscription-based service. Clients submit compiled binaries, which use Veracode models to look for security problems. Unlike conventional code review schemes, the service works without looking at the source code of applications.

The firm, which began trading last year after being spun out by Symantec from its @stake acquisition, is targeting independent software developers and financial sector firms with a service designed to improve the security quality of applications without the need to hand over precious bodily fluids intellectual property in the form of source code. The service is applicable whether a firm is developing applications internally, purchasing software or integrating code from partners.

As the complexity of modern software applications increases, with components assembled from reusable binary components (libraries), security problems are increasingly likely to slip through quality assurance procedures (assuming any are in place). Veracode's pitch is that its service allows clients to screen for problems at a fraction of the price of manual code review. Veracode’s SecurityReview identifies software flaws introduced through either coding errors or malicious intent using binary code and dynamic web analysis techniques. It competes with firms such as Fortify Software.

The addition of backdoor detection capability is designed to boost the appeal of the service, which remains primarily about identifying regular security bugs. The term "backdoor" covers a lot of potential "hidden threats". According to Veracode, backdoors fall into four categories, as follows:

  • Special Credential Backdoors – Involve the hard coding of logic and special credentials into program code. The functions are commonly inserted by developers for either customer support or for debugging. If discovered, attackers can use the short-cuts as a backdoor.
  • Hidden Functionality Backdoors – Routines that allow authentication procedures to be bypassed, sometimes the result of leftover debug code.
  • Rootkits – Functions that hide the presence of what may turn out to be a backdoor.
  • Unintended Network Activity – A common characteristic of backdoors where applications may be found to listen on undocumented ports, make outbound connections to establish a command and control channel, or leak sensitive information over the network via SMTP, HTTP, UDP, ICMP, or other protocols. Occasionally this may be an intended support feature, but it can carry security and privacy risks and therefore ought to be detected.

Automatic detection of software vulnerabilities or malicious code is something of a Holy Grail for the security industry. Simply submitting Windows Vista, for example, to analysis by Veracode’s SecurityReview is not going to unearth every potential security problem. Chris Wysopal, CTO of Veracode and former high profile member of hacker collective L0pht Heavy Industries, told El Reg: "This is no silver bullet. We are not suggesting firms throw away threat modeling, dynamic testing or other elements of their security development lifecycle.

"Our service provides visibility into code, allowing organisations who haven't looked for problems before to add security to their development lifecycle."

Conventional code reviews processes commonly involve inspecting source code. PGP, for example, bases its promises that its encryption software is free of backdoors on the availability of its source code.

Veracode argues testing application binaries is effective as a security validation technique because binary (compiled code) represents the actual attack surface for the hacker. However, it also states that backdoors inserted in open source software might be detected in a matter of weeks whereas backdoors in commercial "closed source" applications might remain undetected for years, a factor that suggests the publication of source code improves security.

However, source code-only analysis runs into problems in the world of proprietary software, because even if you have access to the secret sauce you might not have access to the code of third-party libraries. Veracode claims a lack of access to source code doesn't hamper its efforts.

"Our service provides the same accuracy rates as source code tools. Even source code going through translation," Wysopal said. ®

Beginner's guide to SSL certificates

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
US government fines Intel's Wind River over crypto exports
New emphasis on encryption as a weapon?
To Russia With Love: Snowden's pole-dancer girlfriend is living with him in Moscow
While the NSA is tapping your PC, he's tapping ... nevermind
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
Slap for SnapChat web app in SNAP mishap: '200,000' snaps sapped
This is what happens if you hand your username and password to a 3rd-party
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.