Static Analysis for Vulnerability Discovery | Bug Hunting

Advanced static analysis techniques include data flow analysis to track how data moves through source code, control flow analysis to examine conditional execution paths, taint analysis to trace tainted data from inputs, symbolic execution analysis using symbolic values instead of concrete inputs, abstract interpretation for mathematical modeling of program behavior, dependency analysis for relationships between components, pattern matching and heuristics using machine learning models to identify malicious code patterns, and cross-platform multi-language support for analyzing complex heterogeneous systems.

Static code analysis examines source code without execution to identify defects. Data flow analysis predicts variable values at program points by tracking ranges and exact values, detecting uninitialized reads and memory errors. Control flow analysis examines execution paths through branches and function calls, identifying unreachable code and structural anomalies. These analyses work inseparably. Taint analysis tracks potentially unsafe data from untrusted sources (user input, network) to identify where it reaches unsafe usage points, preventing crashes and data exfiltration. Inductive variable analysis tracks variables with specific value ranges, typically loop counters, to detect range-related errors like array out-of-bounds access.

Advanced static analysis uses SSA form and control flow graphs to detect complex bugs. Resource leak detection identifies paths from resource creation to exit without release operations. Escape analysis determines heap allocation and enables interface method resolution. These techniques handle complex patterns like iterator misuse, database session leaks, and dynamic dispatch issues that simpler analyses miss.

Modern static analysis solutions translate source code into intermediate languages to enable cross-language analysis, building multiple graphs including control flow, data flow, and component interaction models. Different analyzers operate on these representations: structural matching searches for specific code patterns, taint tracking follows data flow from untrusted sources to dangerous sinks to detect injection vulnerabilities, configuration analysis verifies XML/INI settings, and control flow analysis uses state machines to track program states and detect resource leaks. Key limitations include model completeness—missing libraries or unsupported frameworks create false negatives. Static analysis produces four outcome categories requiring management: true positives (real issues needing remediation), unwanted results (low-priority issues), false positives (reported issues that aren't real), and false negatives (real issues not detected). Fine-tuning requires understanding analyzer types and their respective detection capabilities. Three presentation approaches exist: PDF reports (simple but non-interactive), bug tracking systems (integrates into existing workflows), and IDE integrations (best for mature organizations).

Effective static analysis requires constructing abstract syntax trees (ASTs) through lexing and parsing stages, representing code hierarchically with only essential structural information. This hierarchical representation enables efficient backtracking and significantly reduces false positives compared to line-by-line text scanning. Building upon ASTs, control flow graphs represent all possible execution paths through a program using graph notation, with each basic block serving as a node defined by jump targets. Different control structures create distinct graph patterns: if-else branches create divergent paths converging at common exits; loops create cycles; break statements allow alternative exits; goto statements introduce multiple entry points. These representations enable sophisticated security analysis including taint analysis (tracing data flow backward from sinks to detect unsanitized user input) and memory safety verification (detecting use-after-free and double-free errors by tracking pointer allocation and deallocation across all execution paths).

Cyber Triage implements an automated scoring system that analyzes thousands of collected artifacts and categorizes them as bad, suspicious, or normal, helping investigators focus on relevant items. Scores propagate through related artifacts—for example, identifying a file as malware automatically highlights associated processes and events. Investigators navigate through suspicious items using contextual menus to examine related artifacts, view file directories, and mark items as suspicious or bad. The recommendation engine suggests related items based on current selections. User behavior analysis tracks login patterns to identify unusual activity. Program run analysis may generate false positives because legitimate software runs from non-typical locations; users can mark items as 'not a threat' and add them to ignore lists. Reports in HTML or JSON format summarize findings with detailed timestamps, hash values, and malware scanning results.

For malware detection alerts, the triage approach includes: (1) Check EDR and antivirus confidence scores; (2) Look for legitimate admin tools that often trigger false positives; (3) Examine the file name, parent process, and child process to understand the context; (4) If the alert has high confidence score and exact IOCs, isolate the host and change severity; (5) Assign to L2 team for further investigation. This approach helps filter out false positives while ensuring genuine threats receive appropriate response.

Modern AI-powered AppSec platforms automatically filter findings before showing them to developers. When AI determines a finding matches a false positive category, it prevents the alert from reaching the developer entirely—eliminating the 'smoke alarm' problem where developers are interrupted by false alarms. The system learns from multiple feedback sources including developer comments and security team reviews, creating generalized memories applicable across similar situations. Six common false positive types exist: trusted taint data sources, already-sanitized data, non-exposed code, inapplicable rules, third-party code, and rule pattern bugs. Organizations report 20-30% reductions in backlog false positives immediately upon deployment, with additional improvements as autotriage memories accumulate organizational knowledge.

Alert triage execution involves: setting alert status to in progress, assigning the analyst, setting verdict (true positive or false positive), adding comments explaining the analysis, and closing the alert. A False Positive is an alert that indicates a threat but is actually a legitimate activity (like a developer accessing a legitimate GitHub repository). A True Positive is an alert that correctly identifies a real malicious activity. The key is understanding the full context: what the alert describes, what actually happened, and whether the activity is malicious or legitimate.

When using automation tools, generated reports must be manually verified because automation can produce false positives. The verification process involves: (1) Reviewing failed test cases from automation reports, (2) Manually re-executing the failed tests to confirm whether the failure is due to a real defect or a script issue, (3) Eliminating false positives by ruling out environmental issues or script errors, (4) Only reporting confirmed defects into defect tracking systems like Jira. This hybrid approach combines automation efficiency with human judgment to ensure accurate defect reporting.

Semgrep supports custom rule configurations for specific languages using flags like '--config javascript'. For rules not in the default set, users can write custom rules using Semgrep's documented syntax in Simple or Advanced mode, testing them in the playground before deployment. Custom rules integrate via the '--rules' flag pointing to a local rules directory. Community-contributed rules exist on GitHub, but using too many rules simultaneously slows scanning and increases false positives. A strategy of fewer, more precise rules often yields better results than comprehensive rule sets.

This comprehensive section covers Semgrep as a lightweight static analysis tool for finding bugs and scaling security programs. The presenters, Claudio and Pieter, are security researchers with backgrounds at Coverity and Secure Code Warrior. Semgrep differs from traditional tools like Fortify by being more lightweight and semantic-aware, supporting 30+ languages including Python, Java, C#, JavaScript, Go, Rust, Swift, and blockchain languages. The tool works by parsing code into abstract syntax trees and comparing them against rule patterns written in YAML format. Customizing rules is essential because traditional tools generate generic findings that create noise. Research shows customized rules achieve 50% higher fix rates. The section covers core rule writing concepts including ellipsis for generic matching, meta variables for precise capture, pattern not for exclusion, effective false positives, copy-paste rule creation, focus meta variables for concise findings, and type meta variables for type-based filtering.

CodeQL provides default security and quality queries for C/C++, supporting custom queries through its QL language. It offers access to type information, syntax trees, control flow graphs, and resolved call graphs with overload resolution. The system extracts build artifacts into a read-only database, enabling efficient querying. Predicates declare new logical facts about programs, with object-oriented programming concepts constraining matched data sets to enable targeted analysis.

This video teaches how to write custom rules for Semgrep, a code vulnerability scanner, by demonstrating the process of identifying XSS vulnerabilities in PHP code, using the Semgrep Playground to test rule syntax, and configuring policies to run multiple custom checks for automated security scanning.

Semgrep enables secure code analysis through semantic pattern matching on abstract syntax trees (ASTs), where rules use placeholders like ellipsis (...) to match any number of elements and meta variables ($X) to match exactly one element, allowing developers to enforce secure coding practices by writing custom queries that automatically detect and remediate security vulnerabilities across multiple programming languages.

SAST (Static Application Security Testing) is white-box testing requiring source code, finding vulnerabilities early in SDLC, less expensive, and supporting all software types. DAST (Dynamic Application Security Testing) is black-box testing requiring running code, finding vulnerabilities at SDLC end, more expensive, and primarily supporting web applications. SCA (Software Composition Analysis) detects vulnerabilities in open source components without source code access, enabling easier fixes and end-to-end SDLC integration. Tools like Coverity (SAST) and HP Fortify (DAST) are commonly used.

Анализ исходного кода на безопасность включает пять основных видов: SAST (статический анализ) проверяет исходный код без запуска приложения, выявляя уязвимости и баги; SCA (композиционный анализ) проверяет зависимости проекта на предмет уязвимостей; DAST (динамический анализ) тестирует работающее приложение через черный ящик; IAST (интерактивный анализ) работает внутри работающего приложения, обеспечивая более точные результаты; RASP (защита в режиме runtime) обеспечивает комплексную защиту во время работы приложения. Эти инструменты интегрируются в конвейер сборки доставки (CI/CD) поэтапно, начиная с SCA, затем добавляя SAST с Quality Gates, что позволяет своевременно обнаруживать и исправлять уязвимости, повышая безопасность цифровых продуктов.

Four primary categories of security tools help automate application protection: (1) Software Composition Analysis (SCA) examines third-party libraries and dependencies for known vulnerabilities, notifying developers of patches and providing remediation recommendations; (2) Static Application Security Testing (SAST) analyzes source code at rest to identify vulnerabilities before deployment, offering real-time fixes within IDEs; (3) Dynamic Application Security Testing (DAST) scans running applications without internal knowledge, using fuzzing to test requests, responses, authentication, and session management; (4) Interactive Application Security Testing (IAST) combines static and dynamic approaches, analyzing data flows with predefined test cases and suggesting additional tests based on results. Each tool serves different stages of the development lifecycle, enabling continuous security monitoring and remediation.

DevSecOps is an approach that integrates security into the software development lifecycle by combining development, security, and operations, with security placed at the core rather than as an afterthought. The shift left approach enables security issues to be identified and addressed early in the development process, before deployment to production. Key tools for implementing DevSecOps include GetSecrets and Talisman for preventing confidential data commits, SonarQube and Veracode for static application security testing (SAST), OWASP ZAP for dynamic application security testing (DAST), Snyk and 451 for software composition analysis (SCA), and Aqua for container security. Basic security terms include SAST (white box testing for codebase issues), SCA (identifying vulnerabilities in third-party libraries), DAST (testing running web applications), IAST (intensive scanning combining SAST and DAST), and IaC (infrastructure as code security testing).

DevSecOps relies on multiple automated testing methods to secure the software supply chain. Static Application Security Testing (SAST) analyzes code for vulnerabilities like SQL injection and cross-site scripting before execution. Secret scanning detects hard-coded credentials in repositories, preventing accidental exposure. Software Composition Analysis (SCA) scans dependencies against known vulnerabilities (CVEs) to identify insecure third-party components. Dynamic Application Security Testing (DAST) evaluates running applications by sending crafted requests to reveal runtime vulnerabilities. Container image scanning examines Docker layers for insecure configurations, outdated packages, and unnecessary tools that expand the attack surface. Together, these methods provide comprehensive security coverage across the development lifecycle.