3 ms·
Can't you use some form of static analysis to highlight potential vulnerabilities?
by jokoon 8y ago
Can't you use some form of static analysis to highlight potential vulnerabilities?
- nickpsecurity 8y agoYes. It was how I wouldve tried to claim these vulnabilities if I was a black hat. CompSci teams behind tools like Saturn often test them on FOSS code, both known-buggy and patched. The score is how many known bugs they catch vs false alarms. However, they often find new bugs with new tools even in well-trodden code.
- arbitrage 8y agoThe low-hanging fruit amenable to this type of discovery has been plucked years ago.
- justrobert 8y agoStatic analysis will not stop most of the exploits that have happened on iOS/OSX in the recent years. Often it is a situation where multiple processes are working together and there is a way to trick a privileged process into modifying memory in a way it shouldn't.