Code Audit

The Threat

How can you know if a malicious developer has installed a backdoor into your application? A blackbox (no source code) Penetration Test is unlikely to find backdoors. Furthermore, Penetration Testers and Security Teams are at a great disadvantage against real attackers. Real attackers have no scope limitations, no time or budget constraints and no report to write. If you pay for a 5 day pentest, the team or company you hired only has that time to review your security and write a report about what they find. Some security vulnerabilities have only been found after many years of security scrutiny (i.e. Shellshock took about 25 years , Dirtycow around 9 years , etc.), a real attacker can review the security implications of your application, its dependencies and technology stack at a level of depth that a short pentest will just simply not allow. In this context, the Verizon Data Breach Investigations Report for 2019 found that "Organized criminal groups were behind 39% of breaches" and "Actors identified as nation-state or state-affiliated were involved in 23% of breaches"

The Solution

A code audit brings balance to the force and puts penetration testers and security teams at a much better position to use their time more effectively. They have less time than real attackers, but they have the source code so they can review the security of the application much more efficiently. In addition to this, some security issues can only be found via code audits. Furthermore, code reviews are the only way to effectively find backdoors in your applications, which malicious developers or attackers might have introduced. Another advantage of code audits is that mitigation guidance can be better tailored for application developers, we can let you know exactly the affected file and the lines of code where the problem lies and propose ways to fix it.

Customers often combine this test with:

• Mobile/Desktop App Penetration Test and/or Web App Penetration Test: The code alone sometimes leads to suspected vulnerabilities where none are present. By combining a Code Audit with a Penetration Test, Penetration Testers combine the greater insight from the code with the confirmation of security issues at runtime, this allows to more accurately determine if a security vulnerability is exploitable or not and hence provide you with more value for money: Greater code coverage with no false positives or unconfirmed issues. In addition to this, certain vulnerabilities may only be found at runtime, once all your dependencies are loaded together with the application.