3 ms·
While that's a great joke, we actually have a unique way of minimizing false positives compared to the average static analysis tool. We apply code similarity t
by NateLawson 11y ago
While that's a great joke, we actually have a unique way of minimizing false positives compared to the average static analysis tool.
We apply code similarity techniques to reuse analysis across apps, so we don't naively treat a binary as a random jumble of code. So if there's a flaw in a particular parameter passed to a single function, we can find all apps that have the relevant code and then zoom in on just calls to this function. The smaller the number of candidates a matching algorithm has to consider, the less chance of a false positive.
- Natsu 11y agoJust how specifically does it identify its findings? Will it just say "this looks like a common buffer overflow/format string bug/etc." or can it say things like "this embeds openssl 0.9.8q, which is horribly insecure"?
- NateLawson 11y agoYes, the 2nd one. We can tell people: * What components are in the app * Exactly which versions * How they're being used/integrated We give very specific instructions how to fix, telling devs exactly which files or components are causing the issue and why. You might also like the native library dependency graph, which helps you understand the linkage of various libs even in apps that don't have any bugs. We're not going to dump a list of thousands of random potential flaws because we think devs are busy enough as it is. You can see what I mean here (no registration): https://searchlight.sourcedna.com/search https://searchlight.sourcedna.com/search Search for "HBO" or "Modern War" to see a few apps that have an Android M crash bug and the advice we give. [Edited to give more background]
- tptacek 11y agoThe chord graphs on the app pages are new since the last time I saw Searchlight. What do they mean? (Maybe Modern War's is just not clear).
- NateLawson 11y agoThe chord graphs show the linkage relationships amongst all the native libraries in Android apps. Each library has an edge to the other libraries it depends on. To keep it clear, we don't show platform libraries that are too common, like libc. We think it might help devs understand how dependencies are dragged in, especially from code that's not theirs. I'd appreciate feedback on if it actually is helpful or what other things we could make more clear.
- Natsu 11y agoIt looks like a wormhole and a couple of the edges are hard to read, but it does display in an interesting way which libraries are sucking in all the crap.
- tptacek 11y agoCan we get a leaderboard for "libraries sucking in all the crap"? :)
- NateLawson 11y agoAlso a good idea. We're definitely focused on showing relationships both within and externally to each app.