Re: malicious code

From: listsat_private
Date: Mon Jan 27 2003 - 23:20:10 PST

  • Next message: Crispin Cowan: "Re: safe strcpy()?"

    From: "Jeff Williams" <jsquaredat_private>
    
    > I'm not looking for technology.  It is going to be a very long time before
    > software can even find unintentional security errors. I was hoping that
    > someone had done some research on how human code review can find malicious
    > logic. Is the problem exactly the same as searching for inadvertent
    > security flaws, or are there specialized techniques for searching out
    > malicious logic.
    
    ISTR one malicious logic of recent years (TCP wrapper trojan, 1999 ?) had
    different behaviour according to the source port of the connection.
    
    Calling crypt(3) and comparing the result to a stored string might be
    another indicator.
    
    Features such as starting a shell (or anything else) in a program you know
    shouldn't do that would be another.  That's one of the things you can
    prevent with technology (such as SubDomain).
    
    I agree that anything approaching comprehensive detection is hopeless.
    



    This archive was generated by hypermail 2b30 : Mon Jan 27 2003 - 23:41:21 PST