5

Does anyone know of a .dll scanner that searches for known vulnerabilities?

At work, we have a project which uses Nuget packages, and other .dll dependencies. I know there are databases of known vulnerabilities (1, 2), but does anyone know of a tool that will scan a build output folder for .dll names/versions/etc. to spot .dlls with known vulnerabilities?

The goal will be to have this tool run periodically, and alert me if a vulnerability is found in one of our dependencies so that we can update it. Always staying up to date is a testing burden (still working on comprehensive automated testing!) so not updating our dependencies more than we have to is very necessary still for us.

Other information about the environment:

  • C# project/solution with VS 2015 Update 1
  • Does not have to be open source, and if it's pricey the business can probably afford it.
  • What kind of vulnerabilities are you interested in? – mguassa Jan 5 '16 at 15:39
  • @mguassa Preferably I would like any vulnerability (that is known) to be identified. I'm not looking for a static analyzer, but more like a cross check between .dlls in my build output and a vulnerability database. For instance if a .dll in my build output has a known vulnerability on a vulnerability feed then I'd like to know about it :) – Frank Bryce Jan 5 '16 at 15:51
2

Having done software development at an enterprise level, I’m always looking for tools that help my team build better code that’s as secure as possible. There are several different tools that you’ll want to look at deepening on your needs and budget.

  1. A tool I’ve used for doing penetration testing (that will look for things like DLL injection attacks) is Metasploit Toolkit. It’s a penetration testings platform that does a good job of letting you know if you have a problem. It comes in several different flavors, including a community versions. But if you’re not up on this kind of stuff, it’s probably worth paying for the “commercial” version of the product.enter image description here
    As part of Rapid7’s commercial solutions that might want to also look at AppSpider if you need to meet compliancy verification. enter image description here

  2. You could also look at Veracode’s Application and Vulnerability Scanner Tools. Veracode’s suite of tools can be deployed at several different levels through a software dev cycle depending on your needs. enter image description here

  3. Another code development solution I would look at is Checkmarx Static and Source Code Analysis tools. They offer the largest set of language scanners that I know of out of the bunch. This is for active code dev, and when you have access to some level of source code in your development chain. enter image description here

[EDIT]
This is an addition to the list of tools.

If you want to look only at .dll files or look throughout .dll dependencies during development to help understand how they are linked in then look at either PE Explorer or SpyDllRemover.

  1. PE Explorer will let you view .dll dependencies without executing the source code. That way you have a clear picture of what’s linking into your code, especially if you are using 3rd party pre-compiled libraries. enter image description here

  2. SpyDllRemover is really a spyware and root-kit scanner tool that targets things like .dll injection linkages. It’s a very hand tool to find which .dll files are known problems. Combined it with StreamArmor, and you will see WHAT is making an outbound call from your code, and to where. enter image description here
  • Please explain how to use each of these products for DLLs. In particular, Checkmarx sounds off-topic from your description. – Nicolas Raoul Jan 12 '16 at 6:25
  • Given that John Carpenter was asking about app dev with nuget.org/packages I’m assuming that he has some level of source code he's working with. Tools like Checkmarx work on both source, as well as monitoring data flowing from a linked file like a DLL. If you want to learn about each app the companies web sites are going to do a better job than I am at talking about the ways they scan for vulnerabilities. If @nicolas-raoul you want a pure DLL scanner only then look at heaventools.com/PE_Explorer_Dependency_Scanner.htm or securityxploded.com/spydllremover.php – kenjikato Jan 12 '16 at 6:47
  • For each tool, please post a screenshot of how you select the folder to scan DLLs from, and a screenshot of the result showing infected DLLs. If you manage to do that your answer will be much more worthy of a bounty :-) Don't hesitate to make one answer per software. Cheers! – Nicolas Raoul Jan 12 '16 at 7:26
  • Thanks very much for your answer. However, it seems that none of these are what I was looking for. Metasploit and "AppSpider" look like automated network security testing software, Checkmarx offers evaluating static code and not third party libraries, PE Explorer is interesting (but I already know my build's dependencies), and the spyware tools aren't what I need either (I'm not using spyware as a dependency to my project ;)). The only thing here that's close is the binary analysis tool from Veracode, but base on my experience with static code analysis there may be "false positives" – Frank Bryce Jan 12 '16 at 13:42
2

After searching for over a week, it looks to me like the best option is actually an open source option on github. It looks like the databases I pointed to do not store the names of .dlls, so all a tool can do is gather as much metadata about the .dll as possible and do a cross check against a database of known vulnerabilities.

The DependencyCheck tool seems like the best one that I've found.

BEWARE: for our large project, there are many false positives for vulnerabilities found (but those are better than false negatives). There is a way to mark a false positive, though, with the tool so that once you identify them once then the tool skips them in the future.

BEWARE #2: for our large project, this is also quite slow. Eventually I'll have this run daily or weekly on a build server, but for testing I was running locally and it was very slow. I eventually made a VM locally just to cap the CPU cycles/RAM that it was able to consume on my PC.

On the plus side: One very good thing about the project is that it has command line support, and support for Ant and Maven builds.

Thanks to kenjikato for his answer, too. Perhaps one of those tools will help someone else.

EDIT: I was being unfair above about it's speed. My computer I found out yesterday had some sort of virus. After fixing the virus problem the software ran perfectly fine!

1
+100

Look into BlackDuck Software, they provide open source scanning with integration with Visual Studio for license compliance and security vulnerabilities. https://www.blackducksoftware.com/products/black-duck-hub

Black Duck also manages https://www.openhub.net/ which indexes open source code to identify code by fragments and code reused by other projects. So even in the project has no known vulnerabilities, the code used by the code could.

See also: https://www.blackducksoftware.com/products/knowledgebase and https://en.wikipedia.org/wiki/Black_Duck_Software

I have used their services, but I have not used their tools.

  • 1
    Good spot, I hadn't seen this yet! I'll give this a shot, and hopefully someone else will find this useful in the future. – Frank Bryce Jan 14 '16 at 16:09
0

I don't know if this is still relevant to your search for a vulnerability scanner but if you're still looking I'd suggest that you take a look at the list of application security tools over at IT Central Station. All of the reviews on the site have been written by people who have used the tools themselves, which can really help you get a good idea of what it's like to work with the solutions and which one have the features that you need. For example, in a review of HPE Fortify on Demand one user commented "the service itself works to stay abreast and knowledgeable about emerging threats. Rather than have a security team dedicated to that effort, we don’t have to deal with that in a time consuming, direct manner. We don't need to have these skills in-house." I hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.