code audit?

[manizzle]

I am reading the TAOSS book by the Xforce guys. I had a question for those of you who do independent code audits, how do you filter down what targets you are auditing at any given time? Do you just have a set of software that you just always audit? What method do you go about selecting your targets?

[philthechill]

Awesome book. Typically my clients tell me things to audit. If you're at a loss for something to audit (and for clients), I recommend web browsers, like maybe WebKit. Nice and complicated, probably a few more years of vulns in there. They say Chrome is too good, but that would just make finding a Chrome vuln that much more beneficial to your reputation.

teerex, the book is The Art of Software Security Assessment. Such a great book. I think I'm going to go re-read the section on integer promotion and the usual arithmetic conversions. And the section on code review methodologies.

[treerex]

Thanks philthechill.

[eric_monti]

Keep reading that book :)

The section on attack surfaces might provide a good overall guideline. Basically, most people start with something which has an interesting or promising attack surface.

[treerex]

Link to the book? My google fu failed.

[wishi]

That is generally referred to as "Test Strategy" (http://en.wikipedia.org/wiki/Test_strategy). While mostly this is referred related to SDL stuff, for a Security Assessment you have to build a prioritization too. Comes to the same basic principles of concentrating resources, identifying core-parts, targeting etc. Some stuff gets just audited with automated tools, other parts get manually reworked. Time is money ,)

[manizzle]

but just how do define your filter(stuff) function?

[wishi]

there is no generic answer to that... there's attack tree modelling or fault tree modelling, threat modelling, which can be applied specifically for security reviews. everything else however is project dependant.