View The Document

Accession Number:

AD1122149

Title:

Initial Analysis of Underhanded Source Code

Author(s):

Author Organization(s):

Report Date:

2020-04-01

Abstract:

It is possible to develop software source code, called underhanded code, that appears benign to human review but is actually malicious. This is not merely an academic concern; in 2003, an attacker attempted to subvert the widely used Linux kernel by inserting underhanded software. This paper provides a very brief initial look at underhanded source code, with the intent to eventually help develop countermeasures against it. This paper identifies and summarizes public examples of underhanded code, briefly summarizes the literature, and identifies promising countermeasures. It then examines one data set (the Obfuscated V Contest), tries a small set of countermeasures, and measures their effectiveness. This initial work suggests that a small set of countermeasures can significantly reduce the risks from underhanded code. The paper concludes with recommendations on how to expand on this work.

Pages:

68

File Size:

0.43MB

Descriptors:

Identifiers:

SubjectCategory:

Communities of Interest:

Distribution Statement:

Approved For Public Release

View The Document