Using SAST To Prevent Zero Day Vulnerabilities

Brought to you by Gilad David Maayan  

What Is SAST?

Static Application Security Testing (SAST), also known as static code analysis, scans an application's source code, bytecode, or binary files for security vulnerabilities. SAST analyzes an application's code patterns, control flow, and data flow, to identify security weaknesses that attackers could exploit, and help developers remediate them.

SAST works by examining source code and looking for patterns that indicate code quality issues or security vulnerabilities. SAST tools model the underlying source code and evaluate it using a set of rules, both predefined and custom rules defined by the user, to identify vulnerabilities.

Why Is SAST Important?

Many organizations understand the need to test software for vulnerabilities, but only do so at later stages of the development process—for example, when the application is already deployed to a testing or staging environment. Any vulnerabilities discovered need to be communicated to the development team, who have already moved on to other features. They need to reopen their source code, discover the bug, fix it, and redeploy a new version. This wastes time for developers, increases costs, and slows down software delivery.

Another way organizations test for vulnerabilities is through penetration testing. Ethical hackers test applications and code, typically while running in production, report any vulnerabilities they find, and provide proofs of concept showing how attackers can compromise systems. While this is a powerful way to find exploitable vulnerabilities, it is not comprehensive (penetration testers can miss some vulnerabilities due to lack of knowledge of the underlying systems), and again, requires a large effort from developers to identify and fix the issues.

Vulnerability scanning or testing after application deployment is crucial, but it is not enough. Organizations must have a way of discovering vulnerabilities much earlier, making it faster and less expensive to remediate them, and reducing the chance that vulnerabilities make it to production in the first place.

SAST tools encourage a “shift left” mindset. Instead of deploying code and waiting for vulnerabilities to be discovered, every time developers compile code and push it through the CI/CD process, or even as they write code in an integrated development environment (IDE), they can continuously scan it with a SAST tool. The SAST tool provides real-time feedback for developers, just like development tools provide feedback on code that is incorrect or fails to compile. With this information at hand, developers can identify and quickly fix vulnerabilities in their coding environment, in a fraction of the time it would take them to resolve the problem when it is discovered after deployment.

Identifying vulnerabilities in early development stages reduces security risks, decreases the development effort required to address security issues, and accelerates software delivery.

What Is A Zero-day Vulnerability? 

Zero-day vulnerabilities are unknown security issues that expose software or hardware to malicious attack. What makes these vulnerabilities so dangerous is that attackers can take advantage of them before the system vendor is aware of them, and before a security patch is available. 

When attackers discover a zero-day vulnerability, they release a zero-day exploit—malware designed to exploit the vulnerability. If a system is attacked by a zero-day exploit before a patch is available to fix the vulnerability, the attack is virtually guaranteed to succeed.

Perhaps the largest zero-day attack of recent years was Log4Shell. Log4j is a very popular logging library used by Java applications. A vulnerability was discovered that allowed attackers to remotely execute code on any system running Log4j. This led to exposure of millions of high profile business applications and websites to zero-day attacks.

Zero-day Attack Stages

Here are the steps that lead to a zero day attack:

  • Developers unknowingly release software or hardware that contains vulnerabilities.
  • Attackers discover the vulnerability before developers fix them.
  • Attackers create and implement exploit code while the vulnerability is still not addressed.

This period of time, after the availability of a zero-day exploit, but before the release of a patch, is known as the “zero-day window”. In this period, affected systems are completely vulnerable to attack. 

  • Only after the exploits are available, the vendor provides a security patch.

Even at this time, when a patch is available, there is an additional window of time in which system owners may not be aware of the vulnerability, or may be slow to implement the patch.

Preventing Zero Day Vulnerabilities With SAST

According to research published by the SANS Institute, there are three techniques which can be at least partially effective in detecting zero-day exploits:

1. Statistical Techniques:   Algorithms like semantics aware statistic (SAS) use attack profiles from past exploits to detect new ones. The algorithm identifies normal patterns using static code analysis, and identifies anomalies, setting thresholds that determine whether they are malicious or not.

2. Signature-based Techniques:   A “signature” is a mathematical representation of a binary file, which can be used to identify known malicious files. It is traditionally thought that signature techniques are ineffective against zero days. But according to the SANS research survey, some signature-based techniques can be effective against polymorphic worms:

  • Content-based signatures compare the content of a packet to the content of known malicious packets. A new exploit might have a similar implementation to previous ones, making it possible to detect. 
  • Semantic-based signatures analyze the meaning of expressions within the code, looking for rules that can identify the relationship between code elements. They make it possible to produce a generalized signature from only a small number of inputs. For example, based on a few suspicious inputs from an organization’s honeypots or monitoring systems, it might be possible to identify a new exploit.

3. Behavior-based Techniques:   Behavior-based techniques do not consider the underlying code—rather, they analyze the behavior of a running program. Using techniques such as Hidden Markov Models (HMM), these algorithms can analyze past and current interactions and predict a future state. The goal is to detect malicious software that is in early attack stages and has not cause damage yet, but is likely to do damage at a later point in time.

How SAST Can Help

Many SAST tools include both statistical and semantic analysis techniques (#1 and #2 above). As such, depending on their implementation, they might be useful in detecting certain types of zero-day exploits. 

However, an important caveat is that it must be possible to analyze the source code of the exploit. This is the case for script-based exploits, or those that are implanted within an organization’s development environment—but not for many executable-based exploits. 

The behavioral technique (#3) is traditionally not covered by SAST, because it relies on interacting with a running application. However, many vendors are offering hybrid solutions known as interactive application security testing (IAST), which combines static analysis with dynamic analysis. IAST solutions could potentially use all three techniques and thus might have the best chance of identifying an unknown, zero-day threat.

Conclusion

SAST solutions are widely agreed to be an important part of a secure software development lifecycle (SDLC). While they are by no means a guarantee or a sufficient protection against zero-day attacks, they can help in detecting unknown threats. 

By combining SAST with other protective measures, in particular patch management, threat hunting, active monitoring and dynamic application security testing (DAST), organizations can turn the severe threat of zero-day vulnerabilities into a manageable risk.

Image: Vecteezy

You Might Also Read: 

How IAST Improves Application Security & Six Steps to Effective Deployment:

 

« Five Cloud Security Mistakes Your Business Should Avoid
The NSA Hacked Huawei Long Ago »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Securely

Securely

Securely Ltd. is an IT consulting and services firm specializing in PKI solutions and products.

Secarma

Secarma

Secarma provides penetration testing, security assessments, consultancy, and training services to ensure your digital infrastructure is secure from cybersecurity threats.

DefCamp

DefCamp

DefCamp is the most important annual conference on Hacking & Information Security in Central Eastern Europe.

Pathway Forensics

Pathway Forensics

Pathway Forensics is a leading provider of computer forensics, e-discovery services and digital investigations.

Gradiant

Gradiant

Gradiant’s mission is to contribute to the growth and competitive improvement of Galician businesses through technology development and innovation using ICT.

Level Effect

Level Effect

Level Effect is developing new capabilities to bring a unique perspective on proactive network defense and advanced security analytics.

Arkose Labs

Arkose Labs

Arkose Labs' Fraud and Abuse Platform combines Telemetry and adaptive Enforcement Challenges to break down the ROI of fraudsters and protect digital businesses.

SecureStrux

SecureStrux

SecureStrux are a cybersecurity consulting firm providing specialized services in the areas of compliance, vulnerability assessment, computer network defense, and cybersecurity strategies.

oneclick

oneclick

oneclick is a central access and distribution platform in the cloud, enabling the management of the entire technology stack for application provisioning.

Veridium

Veridium

Veridium is a leader in single step - multi factor biometric authentication, designed to safeguard enterprises’ most critical assets.

Stealth-ISS Group

Stealth-ISS Group

Stealth–ISS Group is your extended IT, cyber security, risk and compliance team, providing strategic guidance, engineering and audit services, along with technical remediation and security operations.

Enzoic

Enzoic

Enzoic is an enterprise-focused cybersecurity company committed to preventing account takeover and fraud through compromised credential detection.

BridgingMinds Network

BridgingMinds Network

BridgingMinds Network is an industry leading best practices and IT security training provider in Singapore.

BluSapphire

BluSapphire

BluSapphire is an industry-first, purpose-built, cloud-native, Hybrid XDR platform powered by AI and big data analytics.

Anura

Anura

The world’s most accurate ad fraud solution protects your web assets by eliminating bots, malware and human fraud, ensuring your content is seen by real people.

ImagineX Consulting

ImagineX Consulting

ImagineX Consulting is a cybersecurity-focused boutique technology consultancy whose mission is to help our clients #BeBetter by reducing their corporate risk.