Isolating security threats

1. ISOLATING SECURITY THREATS
Thomas J McCabe
McCabe Technology
tom@mccabetech.com
copyright c March 9 2010 McCabe Technology

2. VOICI L'IDÉE
 Etant donnée une menace cachée pour la sécurité et son chemin associé, nous
pouvons profiter du fait même qu'elle soit cachée. De manière incrémentale, nous
pouvons commencer par la menace et soustraire les bons chemins qui l'entourent,
un par un --- ce qui précise de manière incrementale le sous-chemin fautif, c'est sa
signature. Ou nous pouvons obtenir la signature de la menace par l'exécution de
tous les chemins cyclomatic par soustraction des bons --- laissant la signature faute
absolue.
 La faille de sécurité pouvant être cachée dans des codes source très complexes et
alambiqué fait qu'il est pratiquement impossible de trouver par inspection ---- ce que
permet la technique présentée ici.
copyright c March 9 2010 McCabe
Technology

3. CONTEXT
Many security flaws are compiled and obscured
and within the source code when cyclomatic and
essential complexity are very high; the inspection
process breaks down.
The signature method proposed here is one of the
few realistic ways of detecting such hidden flaws
copyright c March 9 2010 McCabe
Technology

4. DEFINITION OF THREAT SIGNATURE
copyright c March 9 2010 McCabe
Technology

5. SMALL EXAMPLE
 / * 1 * / if (active user)
 / * 2 * / if (my flag)
 / * 3 * / re_input(password,N)
 / * 3 * / write(myfile,N)
 / * 4 * / endif
 / * 5 * / endif
copyright c March 9 2010 McCabe Technology

6. REDUCING THE SIGNATURE
 The good test 1-2-4-5
eliminates the edges (1,2)
and (4,5) from the original
signature
 The reduced signature is the
subgraph ((2,3),(3,4))
copyright c March 9 2010 McCabe Technology

7. SUCCESSIVE GOOD TESTS WILL SUBSET THE
SIGNATURE
copyright c March 9 2010 McCabe
Technology

8. SIGNATURE UPDATE RULE
copyright c March 9 2010 McCabe Technology

9. ORIGINAL FLAW
copyright c March 9 2010 McCabe
Technology

10. REFINING THE FAULT LOCALE
2ND TEST ELIMINATES (1,2) AND (11,12)copyright c March 9 2010 McCabe Technology

11. REDUCING THE FAULT LOCAL (CON’T)
3RD TEST (GOOD) REDUCED LOCALE
copyright c March 9 2010 McCabe Technology

12. ROBUST EXAMPLE
copyright c March 9 2010 McCabe
Technology

13. 2ND TEST(GOOD)
copyright c March 9 2010 McCabe
Technology

14. WHAT WOULD YOU RUN NEXT?
ORIGINAL FLAW SIGNATURE REDUCED FLAW SIGNATURE
copyright c March 9 2010 McCabe Technology

15. GENERALIZING TO MULTIPLE FAULTS
copyright c March 9 2010 McCabe
Technology

16. SIGNATURE TECHNOLOGY ACROSS
ARCHITECTURE
 Highlights modules a fault traverses
 Highlights modules containing signature
 Highlights modules having absolute signature
 Highlights signature edges within modules
copyright c March 9 2010 McCabe
Technology

17. OTHER APPLICATIONS
 Business rule extraction
 Reengineering
 Localizing nasty bugs
copyright c March 9 2010 McCabe
Technology