Veracode hunts for backdoors in outsourced code
Sniffing out malicious code
On-demand application security testing firm Veracode has added detection for backdoors and malicious code to its services. The addition aims to tap into concerns about the integrity of code developed by outsourced contractors.
Veracode’s SecurityReview provides application code review as an online subscription-based service. Clients submit compiled binaries, which use Veracode models to look for security problems. Unlike conventional code review schemes, the service works without looking at the source code of applications.
The firm, which began trading last year after being spun out by Symantec from its @stake acquisition, is targeting independent software developers and financial sector firms with a service designed to improve the security quality of applications without the need to hand over
precious bodily fluids intellectual property in the form of source code. The service is applicable whether a firm is developing applications internally, purchasing software or integrating code from partners.
As the complexity of modern software applications increases, with components assembled from reusable binary components (libraries), security problems are increasingly likely to slip through quality assurance procedures (assuming any are in place). Veracode's pitch is that its service allows clients to screen for problems at a fraction of the price of manual code review. Veracode’s SecurityReview identifies software flaws introduced through either coding errors or malicious intent using binary code and dynamic web analysis techniques. It competes with firms such as Fortify Software.
The addition of backdoor detection capability is designed to boost the appeal of the service, which remains primarily about identifying regular security bugs. The term "backdoor" covers a lot of potential "hidden threats". According to Veracode, backdoors fall into four categories, as follows:
- Special Credential Backdoors – Involve the hard coding of logic and special credentials into program code. The functions are commonly inserted by developers for either customer support or for debugging. If discovered, attackers can use the short-cuts as a backdoor.
- Hidden Functionality Backdoors – Routines that allow authentication procedures to be bypassed, sometimes the result of leftover debug code.
- Rootkits – Functions that hide the presence of what may turn out to be a backdoor.
- Unintended Network Activity – A common characteristic of backdoors where applications may be found to listen on undocumented ports, make outbound connections to establish a command and control channel, or leak sensitive information over the network via SMTP, HTTP, UDP, ICMP, or other protocols. Occasionally this may be an intended support feature, but it can carry security and privacy risks and therefore ought to be detected.
Automatic detection of software vulnerabilities or malicious code is something of a Holy Grail for the security industry. Simply submitting Windows Vista, for example, to analysis by Veracode’s SecurityReview is not going to unearth every potential security problem. Chris Wysopal, CTO of Veracode and former high profile member of hacker collective L0pht Heavy Industries, told El Reg: "This is no silver bullet. We are not suggesting firms throw away threat modeling, dynamic testing or other elements of their security development lifecycle.
"Our service provides visibility into code, allowing organisations who haven't looked for problems before to add security to their development lifecycle."
Conventional code reviews processes commonly involve inspecting source code. PGP, for example, bases its promises that its encryption software is free of backdoors on the availability of its source code.
Veracode argues testing application binaries is effective as a security validation technique because binary (compiled code) represents the actual attack surface for the hacker. However, it also states that backdoors inserted in open source software might be detected in a matter of weeks whereas backdoors in commercial "closed source" applications might remain undetected for years, a factor that suggests the publication of source code improves security.
However, source code-only analysis runs into problems in the world of proprietary software, because even if you have access to the secret sauce you might not have access to the code of third-party libraries. Veracode claims a lack of access to source code doesn't hamper its efforts.
"Our service provides the same accuracy rates as source code tools. Even source code going through translation," Wysopal said. ®