How do you determine if an app is safe or evil?

Author

All Replies

Link Logger
Premium,MVM
join:2001-03-29
Calgary, AB

How do you determine if an app is safe or evil?

In an effort to avoid hijacking another thread I'm going to suggest we split off the discussion of how do you prove or disprove that an app is malicious or not.

Lots of people make claims that apps are safe or malicious, but what do they base such claims on, facts, personal experiences, hearsay, like/dislike for a particular company, technology etc. Now some people might not have noticed but I'm typically a believer of social systems (as bad as they might be, they often exist because nothing better is available), and this applies somewhat to my approach to applications (ie an app is innocent until proven guilty, but to do that we must prove an absence of guilt as that is the only way to prove innocence, burden of proof is on the prosecutor not the defendant, but of course if the defendant has a rap sheet in the software world then we don't use any of their software case closed).

So what do I do when I get a new application that I/we might want to use. First certainly I consider the source of the application and if I have any personal experience with that developer and secondly other people's comments (of course I consider the apparent credibility of the source, see below). If a second party makes a claim about an app, I then seek evidence to back their claim as IMHO too many people in IT (including IT spectators) just spew BS for BS reasons, which is hugely wasteful as then I have to spend time figuring out if its a valid claim or just someone wearing too much tin foil etc or if perhaps there are valid circumstances around their claim which may or may not apply to our situation.

Next depending on the application and the risk factor involved we will pen test the app ourselves and monitor its installation impact (ie what does it install and where, what/when/where/how stuff is started etc, also a good time to scan the heck out of it with X virus scanners etc and see if any of them report it as evil), and monitor it execution (ie what files does it touch, what network activity etc I might even consider fuzz testing it or using other tools to poke it to see how it reacts). This is also when we test its functionality and ultimately suitability for our needs (including other forms of testing including load testing etc). Now certainly virtual machines have drop the bar for applications entering pen testing as it used to be a real hassle setting up real machines and networks for testing (I've had companies in the past where we had multiple labs doing nothing more then testing), long live virtual machines. Now if an app is really 'interesting' etc I might pop the hood on the code and take a look at the exe, disassemble it, reflect it, whatever the technology it was written in requires to explore the app.

If an app passes these requirements we might decide to deploy or likely limited deploy in a test environment again monitoring various activities (including updates etc).

Now the point is after all of this is the application truly 100% safe, not a chance, but this is a fact of reality, that there is no way to prove an application is safe, but we have tested enough to claim due diligence. If someone knows of a way to prove an app 100% safe, I'd love to hear about it and build a company around that as I could use another gazillion dollars which is what the company would make being the only one in the world who could do this. So the assumption is that an app is safe (otherwise we would just skip it altogether, unless we are just feeling playful and wanted to experiment with evil which can be fun in and of itself), and then see if we can prove it unsafe, hence in the end all we can say about an app is based on our experience and testing (which being bound by reality is limited), the application appears to be safe (ie innocent until proven guilty).

Now this is why I hate unsubstantiated claims as to if software is malicious as then I have to look for evidence for their claim and often I can find nothing. So for example when I hear people claim that SysInternal's tools have become malicious since they were taken over by Microsoft, and I can find no evidence and my own testing isn't able to find evidence of this either, then ultimately their claim has resulted in little more then a huge waste of my time and resources and marks that source of information as a write off in the future.

Blake
--
Vendor: Author of Link Logger which is a traffic analysis and firewall logging tool


Tuesday, 15-Dec 04:42:28	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 10 years online! © 1999-2009 dslreports.com.republican-creole page compression OFF