Examining source code for maliciousness and security vulnerabilities

Question

What are some techniques in determining if a particular piece of source code is malicious or vulnerable to malicious attack? I am currently using cppcheck and I am waiting on an install of Rational AppSource. Aside from that and reviewing the US-CERT Secure Coding Guidelines, what else should I be looking at? This is for a very large codebase (150K SLOC).

Answer 1

I don't think there is a tool, or ever will be, that can provide certainty. You do not state if you are looking for accidental or intentionally malicious code. Accidental mistakes are easier to catch, intentional "back doors" impossible, at the tool level, to distinguish from valid code.

I would start with (as you have already mentioned) static checks, and dynamic checks (valgrind).

Internal code review/audit will be required, and depending on importance and project budgets, external code review/audit by specialists would be money well spent. 150kLOC is a pretty average size project, an audit of that should be able to be performed.

Testing the interfaces (blackbox) is essential. Use a security consultant if you do not have experts inhouse.

If you are looking for intentional code, that's a really big problem, as it's pretty easy to hide an intentional vulnerably (e.g. an intentional buffer overflow hidden behind cast to hide the compiler warning), and it's too big code base to be certain of identifying every one. Assume you won't find them all, and deploy accordingly.

Answer 2

There are periodic contests for obfuscated code and code that does something other than what it appears to do. Study the contest entries, and you will discover that this is not a trivial problem to solve.

Answer 3

What are some techniques in determining if a particular piece of source code is malicious or vulnerable to malicious attack?

There are two parts here in the question. If you are looking for intentionally malicious code, then you'll have to resort to performing manual source code reviews by competent examiners. Not every reviewer would be aware of what malicious code looks like, but most reviewers (especially the ones who framed the requirements for the components/modules) would know whether any code obeys the underlying requirements or not.

If you are look for code that is susceptible to malicious attacks, both manual and automated source code reviews will help. Having worked with Fortify SCA in the past, I can only repeat this piece of advice - perform a manual analysis of your application to determine what you need to look for, and use tools to scale the security scan.