2 ms·
I am curious what network detection could be done to detect this sort of thing. Clearly the code needed to make outbound connections to hosts. Some thoughts: i
by chris_wot 6y ago
I am curious what network detection could be done to detect this sort of thing. Clearly the code needed to make outbound connections to hosts.
Some thoughts: if there is an encoded sub domain, flag this as suspicious.
Any code that uses a function to decode a base64 encoded string should be a red flag.
Any newly created thread code should be detected and checked most carefully.
Any others people can think of?
- allyant 6y agoAny decent static code analysers should be able to detect things like this (catch all’s statements, base64 encoding etc), I am surprised none seem to be used for production code.
- derwiki 6y agoIs SCA often set up to run on the fully built end result running on the production machine? I’ve generally seen them as pre-merge-to-source-control.
- WarOnPrivacy 6y ago> what network detection could be done to detect this sort of thing. Clearly the code needed to make outbound connections to hosts. Renting space that shares a netblock with a trusted host could make that more difficult.