Dynamic application security testing, honeypots hunt malware

The following is an excerpt from the Official (ISC)² Guide to the CISSP CBK, fourth edition, edited by Adam Gordon, CISSP-ISSAP, ISSMP, SSCP. This section from Domain 7 familiarizes infosec pros with sandboxing, dynamic application security testing tools and honeypot security systems, which can be used to isolate, detect and thwart malware.

Sandboxing is a form of software virtualization that lets programs and processes run in their own isolated virtual environment. Typically, programs running within the sandbox have limited access to your files and system, and they can make no permanent changes. That means that whatever happens in the sandbox stays in the sandbox. Sandboxing, one alternative to traditional signature-based malware defense, is seen as a way to spot zero-day malware and stealth attacks in particular.

Malware uses a variety of techniques and approaches to evade detection. One of these techniques delays the execution of malicious code so that a sandbox times out. However, to do this, the malware does not simply sleep. Instead, the malware performs some useless computations that give the appearance of activity. The stalling technique used by the malware works because it appears to the sandbox as if the malware is simply executing functions that any normal program would, and from the point of view of the malware analysis system, everything is normal.

To monitor malware, a sandbox introduces hooks. These hooks can be inserted directly into a program to get notifications (callbacks) for function or library calls. The problem with direct hooks is that the program code needs to be modified, and this can be detected by malware or interfere with dynamic code generation. But the main problem with hooking stem calls is that the sandbox cannot see any instruction that the malware executes between calls. This is a significant blind spot that malware authors can target; and they do so with code that runs between system calls. Another evasive method is carried out through environmental checks. Malware authors can add novel, zero-day environmental checks related to the operating system and manipulate the return value as an evasive maneuver that forces vendors to patch their sandbox to catch it.

The security practitioner needs to rely on third-party services and systems in order to find and detect these kinds of threats within the enterprise. In addition, there may be other threats that go undetected from third-party software and services that are being consumed by users in the organization as well. The use of different technology vendors scanning tools for malware and virus mitigation is one area that the security practitioner can act upon fairly easily. The need to contract with a third-party company to help provide dynamic application security testing (DAST) services may be a new thought process for many security practitioners.

DAST technologies are designed to detect conditions indicative of a security vulnerability in an application in its running state. Most DAST products test only the exposed HTTP and HTML interfaces of web-enabled applications; however, some products are designed specifically for non-web protocol and data malformation (for example, remote procedure call, Session Initiation Protocol [SIP], and so on).

The following are several areas where DAST tools are providing interesting innovative approaches to the security issues that face the enterprise today:

Dynamic application security testing as a service
The market for dynamic testing as a service is growing, and some vendors only offer their solution as a service. The security professional may prefer to use a product and a service from the DAST vendor. For example, they may want to perform testing on their more sensitive applications on-premises using a DAST product, testing on their less-sensitive applications via DAST as a service, or testing on deployed applications as a service, with testing of applications in the QA phase of the development process using on-premises DAST products.

The ability to crawl and test Rich Internet Applications (RIA)
A hallmark of web 2.0 applications is the use of RIA, mostly in the form of JavaScript and Ajax frameworks. In addition, many applications include large amounts of client-side logic in the form of Adobe Flash, Flex, and Microsoft's Silverlight.  The use of client-side RIA logic complicates how applications are crawled and how traditional dynamic application security testing is performed because the JavaScript and other types of code are rendered at the client, not at the server.

HTML5
HTML5 is not a single standard, and the multiple standards that collectively represent HTML5 are at different levels of maturity and adoption. Testing HTML5 and keeping up with the fluid standards is an emerging requirement for all DAST products.

Web protocols
The ability to crawl and test applications that use other types of interfaces carried over web protocols. For example, many dynamic application security testing products test web services using protocols and formats, such as Simple Object Access Protocol (SOAP), representational state transfer (REST), Extensible Markup Language (XML), and JavaScript Object Notation (JSON).

Static application testing capabilities (SAST)
For comprehensive application security testing, applications should be able to be tested from the "inside out" using static analysis and from the "outside in" using dynamic analysis.

Interactive security testing
Some of the testing providers enable interaction between their static and dynamic security testing techniques. One of the most common ways is to instrument the application while it is being tested dynamically. This provides more detailed information (such as identifying the line of code where a vulnerability occurs and assessing the code coverage of testing). While this may not be suitable for production applications, this approach is quite useful in QA testing in order to provide more meaningful results to developers.

Comprehensive fuzz testing
Some DAST products are designed specifically to expand well beyond web protocols to include non-web protocols (for example, remote procedure calls, Server Message Block, Session Initiation Protocol [SIP], and so on) as well as data input malformation. This is especially critical for the dynamic security testing of applications used within embedded devices, such as storage appliances, telecommunications and networking equipment, directories, automated teller machines, medical devices, and so on.

Testing mobile and cloud-based applications
Ideally, mobile applications would be tested with SAST and DAST; however, pure dynamic application security testing can add value. Beyond the use of RIA and HTML5 discussed previously, most Android and iOS applications are web-like in nature and communicate over web or RESTful HTTP-based protocols. At a minimum, the exposed interfaces of the applications should be testable using DAST. Many of the mobile applications communicate with cloud-based applications on the back end, which must also be tested. In addition, many applications have specific code paths for supporting mobile devices. In order to test these properly, DAST products must emulate a number of mobile browsers.