Article View: comp.security.misc
Article #981Steps to verify cleanliness of code on Unix boxes
From: Larry W. Virden
Date: Wed, 27 Jan 1993 13:54
Date: Wed, 27 Jan 1993 13:54
21 lines
1560 bytes
1560 bytes
Anyone have some steps to take to look at a program to see if it accidentally or intentionally takes actions which could be considered dangerous? For instance, on many micros, there are programs which will scan for certain operations and warn the user of a possible danger. I think that such a tool that could be run on a set of code would be very useful. What types of things do you look for when you are examining a new piece of code? For instance, the following might be some things to particular examine - none are necessary 'evil' but are conditions which have the possibility for accidents or abuse. 1. Does it require root or other specialized privleges? 2. Does it attempt to send email to off site addresses? 3. Does it attempt to perform chmod's or chown's on files that it does not create? 4. Does it attempt to delete files that it does not create? -- Larry W. Virden UUCP: osu-cis!chemabs!lvirden Same Mbox: BITNET: lvirden@cas INET: lvirden@cas.org Personal: 674 Falls Place, Reynoldsburg, OH 43068-1614
Technical Details
Message-ID:
<1993Jan27.135822.18186@cas.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!news.univie.ac.at!scsing.switch.ch!univ-lyon1.fr!ghost.dsi.unimi.it!rpi!usc!sdd.hp.com!caen!malgudi.oar.net!chemabs!lwv26Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!news.univie.ac.at!scsing.switch.ch!univ-lyon1.fr!ghost.dsi.unimi.it!rpi!usc!sdd.hp.com!caen!malgudi.oar.net!chemabs!lwv26 From: lwv26@cas.org (Larry W. Virden) Subject: Steps to verify cleanliness of code on Unix boxes Message-ID: <1993Jan27.135822.18186@cas.org> Sender: usenet@cas.org Reply-To: lvirden@cas.org (Larry W. Virden) Organization: Nedriv Software and Shoe Shiners, Uninc. Date: Wed, 27 Jan 1993 13:54:23 GMT Lines: 21