How Malicious Code Enters Applications

As the backbone of modern business operations, applications are frequently targeted by sophisticated malicious threats. In this blog post, we provide a high-level overview of how malicious code can enter your software applications. We look at different forms of malicious code, their entry points, practical tools and strategies for detection & prevention, focusing on innovative solutions.

Overview of Malicious Code Entry

Types of Malicious Code

In AppSec, understanding the various types of malicious code is fundamental. These malicious entities, ranging from viruses to spyware, each possess unique traits and attack vectors.
Here are some of the most common types of malicious code: 

1. Viruses: are malicious programs that attach themselves to clean files and spread throughout a computer system, infecting files with malicious code. For instance, the ILOVEYOU virus in 2000 caused widespread damage globally by overwriting files and replicating itself via email.
2. Worms: Like viruses, they can spread autonomously without a host file. Worms often exploit network vulnerabilities to spread across connected systems. The Conficker worm, discovered in 2008, rapidly spread by exploiting a vulnerability in Windows OS and created a massive botnet.
3. Trojans: are deceptive software that appears legitimate but performs hidden, harmful functions. Trojans can create backdoors in your security to let other malware in. A notable example is the Zeus Trojan, known for stealing banking information by logging keystrokes and form grabbing.
4. Ransomware: This malicious software encrypts a user's data and demands payment for the decryption key. The WannaCry ransomware attack in 2017 affected hundreds of thousands of computers worldwide, encrypting data and demanding Bitcoin ransom payments.
5. Spyware: Designed to monitor and collect information about the user secretly. It can track everything from web browsing habits to personal information. CoolWebSearch, a well-known spyware, hijacked web browsers and redirected users to unwanted websites.
6. Adware: Though not always malicious, adware can be annoying as it displays unwanted advertisements on your computer. Some adware tracks your browsing behavior to serve targeted ads. Gator was a prevalent adware that displayed ads and collected user data without consent.
7. Rootkits: These are designed to obtain administrator-level control over a computer system without being detected. Rootkits can manipulate system functions and hide other malware. The Sony BMG rootkit scandal in 2005 involved CDs that secretly installed rootkits on users' computers.
8. Keyloggers: These monitor and record keystrokes, allowing attackers to capture sensitive data like passwords and financial information. The FBI reportedly developed a keylogger software called Magic Lantern, used in criminal investigations to gather encryption keys and other sensitive data by recording keystrokes.
9. Botnets: Networks of infected computers controlled remotely by an attacker, usually used for coordinated attacks or to send spam. The Mirai botnet, known for converting networked IoT devices into remotely controlled bots, caused massive internet outages.
10. Logic Bombs: These are malicious code snippets that trigger a malicious action when certain conditions are met, like a specific date or the launching of a particular program. A well-known case is the Chernobyl virus, which acted as a logic bomb, wiping data on infected systems on a specific date.

From viruses to botnets, each type of malicious code presents a unique challenge in cybersecurity.

Infiltration Pathways of Malicious Code

The pathways through which malicious code breaches applications are as diverse as the threats themselves. Understanding the common entry points is crucial for developing effective defense strategies:

• Unpatched Software Vulnerabilities: Outdated or unpatched software can be easily exploited, allowing attackers to insert malicious code.
• Insecure APIs: Weakly secured APIs can be a gateway for attackers to inject malware or extract sensitive data.
• Code Injection: Vulnerabilities like SQL injection and Cross-Site Scripting (XSS) where attackers can insert harmful code into the application.
• Phishing Attacks: Tricks users into downloading malicious code or revealing sensitive information, leading to application compromise.
• Third-party Libraries and Dependencies: Using external code with hidden vulnerabilities can inadvertently introduce malicious code into the application.
• File Upload Vulnerabilities: Applications allowing file uploads without proper validation and scanning can be exploited to upload malware.
• Buffer Overflow: This attack overruns application memory, potentially allowing attackers to execute malicious code.
• Man-in-the-Middle (MITM) Attacks: Attackers intercept communication between the user and application to inject or modify data.
• Poor Authentication and Authorization Controls: Weak security in these areas can allow unauthorized access and the possibility of code injection.
• Cross-Site Request Forgery (CSRF): Exploits a user's authenticated session, potentially leading to unauthorized actions and code execution.

Resources such as the OWASP Top 10 and the SANS Top 25 provide extensive insights and guidelines for a deeper understanding of these common tactics.

Detection Tools and Techniques

Detection tools and techniques form the cornerstone of a robust cybersecurity strategy. They encompass a range of approaches, from analyzing source code for potential weaknesses to simulating real-world attacks. These methodologies are vital for uncovering and addressing security vulnerabilities:

• Static Application Security Testing (SAST): SAST involves analyzing source code (byte or binary) for vulnerabilities without executing the program. It's typically done early in the development process.
  Tools like Checkmarx and Veracode fit into this category. It scans the source code to identify security vulnerabilities, coding flaws, and compliance issues, enabling developers to address these issues during the coding phase.
• Dynamic Application Security Testing (DAST):  DAST tools test applications from the outside while they are running. It simulates external attacks to identify security vulnerabilities. Burp Suite and Invicti are prominent DAST tools. It operates while the application is in execution, simulating real-world attacks to identify vulnerabilities and security holes that would be visible to an attacker.
• Interactive Application Security Testing (IAST): IAST combines aspects of both SAST and DAST. It often works within the application during testing phases to identify real-time vulnerabilities. Tools that offer IAST capabilities analyze code for vulnerabilities during runtime, providing immediate feedback to developers. They bridge the gap between SAST and DAST, offering a more integrated approach to application security testing.

Integrating SAST, DAST, and IAST in the AppSec security posture represents a comprehensive approach to vulnerability detection. By combining static, dynamic, and interactive testing methods, these tools offer a multifaceted defense against cyber threats. Let's next examine the strategies for evaluating and prioritizing the risks they uncover.

Risk Scoring

Risk Scoring is a key element of your Security Posture Management (see below). As a metric it quantifies your security posture based on the number and severity of the security issues that affect your assets and applications:

• Automated Vulnerability Identification: Security tools scan systems and applications to identify potential vulnerabilities automatically using various detection methods like signature-based, anomaly-based, or behavior-based techniques.
• Risk Score Assignment: Each identified vulnerability is assigned a risk score. This score is typically calculated based on several factors:
  • Severity of the Vulnerability: Assessed based on the potential impact of the exploited vulnerability. This may include the extent of potential damage, data breach severity, or system compromise.
  • Exploitability: Evaluate how easily an attacker can exploit the vulnerability. This considers factors like the exploit's complexity, required skill level, and availability of exploit tools.
  • Prevalence and Exposure: Considers how widespread the vulnerability is and how much the system is exposed to potential exploitation.
  • Mitigation and Remediation Difficulty: Assesses the effort required to mitigate or patch the vulnerability.
• Prioritization Based on Risk Score: The tool ranks the vulnerabilities based on risk scores, allowing security teams to prioritize their response effectively.
  • High-Risk Vulnerabilities: These are prioritized for immediate action, typically requiring urgent patching or mitigation.
  • Medium and Low-Risk Vulnerabilities: Addressed on a scheduled basis, depending on their potential impact and likelihood of exploitation.
• Risk Score Algorithms: There are specific algorithms to combine the abovementioned factors into a single risk score. Standard models include CVSS (Common Vulnerability Scoring System) and proprietary algorithms developed by security tool vendors.
• Dynamic Risk Scoring: Some advanced threat intelligence tools and frameworks offer dynamic risk scoring, where the risk score of a vulnerability can change over time based on new information, threat landscape evolution, or changes in the environment.
• Integration with Security Response: The risk scoring is integrated with the organization’s security response plan, ensuring that mitigation efforts align with the prioritized risks.

Tools equipped with risk-scoring capabilities can quickly highlight the most critical issues that need immediate attention, streamlining the decision-making process.
Kondukto provides two levels of risk scoring: on a project and on a vulnerability level: 

• Projects that are internet-facing can automatically be identified through CNAPP integrations and assigned an appropriate label. Vulnerabilities in these projects can then be given a higher priority over others.
• On a vulnerability level, Kondukto can integrate with threat intelligence tools like Mandiant and frameworks like EPSS or CISA KEV to provide further context about the probability of an exploit, whether the vulnerability is actively being exploited in the wild or if there is a known fix for the vulnerability at hand.

Security Posture Management

Security Posture Management is a set of practices and technologies that help you assess, monitor and reduce the risk related to data & resources in your environments. Some of these best practices are: 

• Strengthen Application Defenses: Implement application-specific security measures like Web Application Firewalls (WAF) and secure coding practices.
• Enforce Application Security Policies: Develop and uphold strict application development, deployment and maintenance policies.
• Perform Application Vulnerability Assessments: Regularly conduct security audits and application assessments to identify and address vulnerabilities.
• Educate Development Teams: Provide ongoing training to development teams on secure coding practices and emerging security threats with platforms like Secure Code Warrior, SecureFlag and Avatao.
• Establish Incident Response for Applications: Develop response plans for potential application security breaches.
• Ensure Regular Updates and Patch Management: Maintain application and library updates to mitigate known vulnerabilities.
• Evaluate Third-Party Components: Rigorously assess the security of third-party libraries and APIs integrated into applications.

By focusing on these best practices, enforcing robust security policies and taking proactive measures like developer training and recurring audits, you can build a strong and responsive barrier against application-level cyber threats. Deploy detection tools that fit your specific applications and that collectively cover your whole software development lifecycle. Finally, by using Risk Scores effectively to keep you focused on the high priority and most urgent threats and vulnerabilities, you will be able to stay on top of the noise.