Lock Up Your Code

It has emerged that the latest set of high-profile cyber attacks were against source control management systems. For those not in the software engineering business, this is where source code for applications is held during development. A strange target you might think?

Cyber-criminals have been taking a longer and longer view of their activities and while the vast majority go for the quickest route to cash, stealing credit card and bank account details etc, there are those who are becoming more devious. So, why go after code? There are several reasons…

  1. Intellectual Property theft… if you have the source code, or other product designs then you could sell them on to the competition, or back to the original company.
  2. You can look for vulnerabilities to exploit. Having the code means you can find issues and use them – either by selling the vulnerability on the underground economy, or once more selling it back to the company it was stolen from.
  3. You could look to introduce vulnerabilities or  backdoors into the code. Just because someone has accessed the code, doesn’t necessarily mean that they have only take a copy of the code, they could have also changed some that is there.

If you think this is all a little far-fetched, then there was another report this week of a USB battery charger which has a backdoor in it, enabling unauthorized access to the system. Not too good for the reputation of the company… This will no doubt be the first of many such attacks. Software is complex at the best of times, the introduction of a backdoor is not hard to do… and as long as no-one spots it, it can offer a great deal of leverage for the cyber-criminal. Spotting a 20 line backdoor in a million lines of code is tough!

Development systems and code repositories should be afforded the same security as production ones. Segregated data and networks with intrusion detection / prevention systems will help in protecting your Intellectual Property – before someone else exploits it.

Guy Bunker

March 9, 2010 | Filed Under cyber-crime, data-loss, security 

comments

Leave a Reply