How to recognize malicious source code? [closed]

Answer 1

While this does not really answer your question, I think a really interesting paper to read is Reflections on Trusting Trust by Ken Thompson. It raises a fascinating point that even if your source code is free of defects (viruses, trojans, etc.), you might still be producing defective executables if your compiler is defective. And even if you rebuild the compiler from clean source code, you can still have the same problem.

Unless you're building your computer from the ground up with your own microchips, hand-assembling your own BIOS, writing your own operating system, compiler, and software, you have to draw the line somewhere and trust that the hardware and software upon which you're building your systems are correct.

Answer 2

If you really want to learn, and are willing to put in the time, your time is probably better spent on google to find then participate in a greyhat community. this topic is highly complex.

if your question is as simple as "what's an easy way to recognize a virus from its source code", well, it probably won't be easy, because there's infinite ways to go about it.

Answer 3

There is no difference between malicious code and an unintentional security bug.

You might as well be asking "How can I write a useful program that has no bugs and is impossible to exploit".

As we all learn in CS its impossible to even write debuggers to catch infinite loops let alone intelligent malevolence.

My advice for security conscious applications is an ex(p|t)ensive code review and use of commercially available static analysis software.

Answer 4

If you want to recognize malware, you must know how it works. This means researching malware and aquirering the skill to produce malware.

• search for 29A - they wrote papers on virus
• read about rootkits (there are even books on it)
• read about reverse engineering
• read source code of malware - there's plenty of it in the web.
• learn assembler
• learn about your OS
• reverse the os-kernel
• get clam-av, check the source

I won't provide links here. They are easily found though.

Answer 5

You could check for the Evil Bit on incoming packets... http://en.wikipedia.org/wiki/Evil_bit

Answer 6

You ask "What is it that most malware will want to do?".

An excellent source for this sort of information is The Hacker Quarterly, which is so mainstream, you may find it at your local bookstore, or you can subscribe online to get it mailed to you.

It was started to help hackers and phreakers share information. It is still very popular with hackers today and is considered by many to be controversial in nature.

Contents of the Current Issue include:

• Not The Enemy
• Regaining Privacy in a Digital World
• The Security-Conscious Uncle
• Why the "No-Fly List" is a Fraud
• TELECOM INFORMER
• Finding Information in the Library of Congress
• Hacking the DI-524 Interface
• Simple How-to on Wireless and Windows Cracking
• If You Can't Stand the Heat, Hack the Computers!
• Security: Truth Versus Fiction
• Hacking the Beamz
• HACKER PERSPECTIVE: Jason Scott
• iTunes Stored Credit Card Vulnerability
• Zipcar's Information Infrastructure
• The How and Why of Hacking the U.N.
• Listen to Radio Hackers!
• HACKER SPACES - EUROPE
• Abusing Metadata
• Verizon FIOS Wireless Insecurities
• TRANSMISSIONS
• Using Network Recon to Solve a Problem
• Suing Telemarketers for Fun and Profit
• HACKER HAPPENINGS
• Plus LETTERS and MARKETPLACE

There is also an excellent series of articles on Hacking at Wikipedia and on Computer Viruses.

... And yes, it is important for programmers to understand how hacking and code breaking works, so they can do the best they can to circumvent it in their programs.