<HTML dir=ltr><HEAD><TITLE>Re: [WEB SECURITY] Re: [SC-L] Integrated Dynamic and Static Scanning</TITLE>
<META content="text/html; charset=unicode" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.18813"></HEAD>
<BODY>
<DIV dir=ltr id=idOWAReplyText32056>
<DIV dir=ltr><FONT color=#000000 size=2 face=Arial>Without instrumentation this will be major, costly, epic fail. Assuming life without it for the time being, I think the future is brighter for dynamic-to-static integration. Let's consider a few of the logistical issues going the opposite way - from static findings to exploit generation after a simple source-to-sink, tool-identified path for </FONT><FONT size=2 face=Arial>a SQL injection vulnerability found deep in the business logic of an application:</FONT></DIV>
<DIV dir=ltr><FONT size=2 face=Arial></FONT> </DIV>
<DIV dir=ltr><FONT size=2 face=Arial>1. The application has no idea what it's method/scheme/hostname/port for invoking it should be. It seems like a simple thing to deduce, but I guarantee it's a huge PITA for anyone actually doing the work to make it 100% reliable. After all, if it's not 100% reliable, how can we claim that this technology helps us any more than the static trace alone? The value-add here is in ease of verification. A mistake made in figuring out any of these values will mean that the exploit will not be verified and will turn out to be a false negative. All the infrastructure touched before the app makes this a complex problem - and if this little tiny bit of obvious information is complex to generate, what hope is there of getting the rest of the complex set of circumstances right that are required to re-create a vulnerability in action? Realistically the VA and the SA (VA+SA, it's everywhere you want to be) need to maintain synchronization per request to make this a semi-sane idea.</FONT></DIV>
<DIV dir=ltr><FONT size=2 face=Arial></FONT> </DIV>
<DIV dir=ltr><FONT size=2 face=Arial>You could hardcode these values, but what if you use a mix of values and therefore aren't static across the application? Knowing the tools, I know the finding will still be reported somewhere deep in a "don't bother checking these" category. =)</FONT></DIV>
<DIV dir=ltr><FONT size=2 face=Arial></FONT> </DIV>
<DIV dir=ltr><FONT size=2 face=Arial>2. The SQL injection vulnerability would have to understand the query and how to manipulate it in order to generate a meaningful query and resulting exploit. If proof that you can cause a syntax error is enough to verify exploitability then I guess this isn't such a big deal. But what if the syntax error never reaches the screen? Have you verified anything in this case?</FONT></DIV>
<DIV dir=ltr><FONT size=2 face=Arial></FONT> </DIV>
<DIV dir=ltr><FONT size=2 face=Arial>3. The application would have no idea what server-side forwards, virtualized paths and filters were traversed to reach the application's action entry point. This reverse-engineering is especially hairy in J2EE, yet would be needed to be reliably generated in order to form an exploit. Put Spring on top of it and we're talking complexity that's practically impossible to re-model.</FONT></DIV>
<DIV dir=ltr><FONT size=2 face=Arial></FONT> </DIV>
<DIV dir=ltr><FONT size=2 face=Arial>This is just the tip of the iceburg, I think. </FONT><FONT color=#000000 size=2 face=Arial>The only technically feasible application of this kind of integration can be found in instrumentation ideas </FONT><FONT color=#000000 size=2 face=Arial>like Fortify's "attack path tracing", which would ideally be tied into unit testing and regression testing when it makes sense. Are there any competitors to them in this market? Does anybody have real-life experiences with this tool set?</FONT></DIV>
<DIV dir=ltr><FONT size=2 face=Arial></FONT> </DIV>
<DIV dir=ltr><FONT size=2 face=Arial>The idea of VA+Fortify+ptrace is intriguing, but we're looking at an explosion of complexity that I doubt many customers have the expertise to manage. +1 to Fortify for innovation, but can we get some technical information or user experiences here?</FONT></DIV>
<DIV dir=ltr><FONT size=2 face=Arial></FONT> </DIV>
<DIV dir=ltr><FONT size=2 face=Arial>Arshan</FONT></DIV>
<DIV dir=ltr><FONT size=2 face=Arial></FONT> </DIV>
<DIV dir=ltr><FONT size=2 face=Arial>P.S. Has anybody talked about cost/value analysis? It'd be cool tech, for sure, but is it worth it? I'm not trying to dissuade anybody from pursuing these ideas, but I just want to make sure all the cards are on the table.</FONT></DIV>
<DIV dir=ltr><FONT size=2 face=Arial></FONT> </DIV></DIV>
<DIV dir=ltr><BR>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>From:</B> Jeremiah Grossman [mailto:jeremiah@whitehatsec.com]<BR><B>Sent:</B> Thu 8/6/2009 8:22 PM<BR><B>To:</B> James Landis<BR><B>Cc:</B> sc-l@securecoding.org; websecurity@webappsec.org<BR><B>Subject:</B> Re: [WEB SECURITY] Re: [SC-L] Integrated Dynamic and Static Scanning<BR></FONT><BR></DIV>
<DIV>
<P><FONT size=2>Good catch, that is exactly right. My oversight. A while back Fortify <BR>released a white paper entitled "Misplaced Confidence in Application <BR>Penetration Testing" [reg required]<BR><BR><A href="http://www.fortify.com/security-resources/library/overviews.jsp">http://www.fortify.com/security-resources/library/overviews.jsp</A><BR><BR>Tools also available to help measure.<BR><BR><BR>On Aug 6, 2009, at 5:04 PM, James Landis wrote:<BR><BR>> There's a big claim in area 2) that actually does exist: <BR>> instrumentation of static code to give you code coverage metrics for <BR>> your dynamic scanning efforts. Well, maybe it's not area 2), but <BR>> it's definitely a static analyzer vendor feeding dynamic analysis.<BR>><BR>> -j<BR>><BR>> On Thu, Aug 6, 2009 at 4:30 PM, Jeremiah Grossman <jeremiah@whitehatsec.com<BR>> > wrote:<BR>> Hey all,<BR>><BR>> I've been monitoring this thread [1] and some excellent points have <BR>> been raised (cross-posting to websecurity as the subject matter <BR>> applies). I'm personally very interested in the potential benefits <BR>> of an integration between dynamic and static analysis scanning <BR>> technology. The spork of software security testing. The desire of <BR>> many is a single solution that unifies the benefits of both <BR>> methodologies and simultaneously reduces their respective well-<BR>> described limitations. For at least the last couple of years there <BR>> have been vendors claiming success in this area, of which I remain <BR>> skeptical.<BR>><BR>> A brief explanation of the bi-directional and somewhat simple <BR>> sounding innovations that vendors are trying to develop:<BR>><BR>> 1) Dynamic Scanner -> Static Analyzer<BR>> A dynamic analysis engine capable of providing HTTP vulnerability <BR>> details (URL, cookie, form etc.) to a static analysis tool. Static <BR>> analysis results narrowed down to a single line of insecure code or <BR>> subroutine to speed vulnerability remediation. Prioritize issues <BR>> that are located in a publicly available code flow vs. those that <BR>> are not technically remotely-exploitable. Isolate security issues <BR>> where source code was not available, such as third-party libraries.<BR>><BR>> Static Analyzer -> Dynamic Scanner<BR>> 2) A static analyzer capable of providing a remotely available <BR>> attack surface (URLs, Forms, etc.) to a dynamic analysis tool. <BR>> Dynamic analysis may realize additional testing comprehensiveness, <BR>> measurement of coverage depth, and hints for creating exploit proof-<BR>> of-concepts. Not to mention able to provide more detailed <BR>> application fix recommendations.<BR>><BR>> <vendor bias><BR>> As it stands currently, the state-of-the-art is basically a <BR>> reporting mash-up. Very little of the aforementioned advancements <BR>> have been proven to funtion outside of the lab environment. If <BR>> anyone has evidence to the contrary they can point to, please speak <BR>> up. For those curious as to Tom Brennan's comment, these are the <BR>> areas Fortify and WhiteHat are together working on.<BR>> </vendor bias><BR>><BR>> This is an excellent time to be in the application and software <BR>> security industry. Over the next few years there is going to be a <BR>> lot of innovation and awareness in the "defense" side of the <BR>> industry. Talent, skill, and experience is going to command a premium.<BR>><BR>><BR>> [1] <A href="http://www.mail-archive.com/sc-l@securecoding.org/msg02731.html">http://www.mail-archive.com/sc-l@securecoding.org/msg02731.html</A><BR>><BR>><BR>> Regards,<BR>><BR>> Jeremiah Grossman<BR>> Chief Technology Officer<BR>> WhiteHat Security, Inc.<BR>> <A href="http://www.whitehatsec.com/">http://www.whitehatsec.com/</A><BR>> blog: <A href="http://jeremiahgrossman.blogspot.com/">http://jeremiahgrossman.blogspot.com/</A><BR>> twitter: @jeremiahg<BR>><BR>> ----------------------------------------------------------------------------<BR>> Join us on IRC: irc.freenode.net #webappsec<BR>><BR>> Have a question? Search The Web Security Mailing List Archives:<A href="http://www.webappsec.org/lists/websecurity/archive/">http://www.webappsec.org/lists/websecurity/archive/</A><BR>><BR>> Subscribe via RSS:<A href="http://www.webappsec.org/rss/websecurity.rss">http://www.webappsec.org/rss/websecurity.rss</A> [RSS <BR>> Feed]<BR>><BR>> Join WASC on LinkedIn<BR>> <A href="http://www.linkedin.com/e/gis/83336/4B20E4374DBA">http://www.linkedin.com/e/gis/83336/4B20E4374DBA</A><BR>><BR>><BR><BR><BR>----------------------------------------------------------------------------<BR>Join us on IRC: irc.freenode.net #webappsec<BR><BR>Have a question? Search The Web Security Mailing List Archives:<BR><A href="http://www.webappsec.org/lists/websecurity/archive/">http://www.webappsec.org/lists/websecurity/archive/</A><BR><BR>Subscribe via RSS:<BR><A href="http://www.webappsec.org/rss/websecurity.rss">http://www.webappsec.org/rss/websecurity.rss</A> [RSS Feed]<BR><BR>Join WASC on LinkedIn<BR><A href="http://www.linkedin.com/e/gis/83336/4B20E4374DBA">http://www.linkedin.com/e/gis/83336/4B20E4374DBA</A><BR><BR></FONT></P></DIV></BODY></HTML>