Scare - Static Code Analysis Recognition Evasion

Explore the limitations of static code analysis (SCA) tools in detecting intentionally concealed security vulnerabilities during this conference talk from the Hack In The Box Security Conference. Delve into various techniques malicious actors can use to evade SCA algorithms, including covert data flow, deep call stacks, circular calls, source mining, data hubs, and taint laundering. Gain insights from experienced SAP security researcher Andreas Wiegenstein as he demonstrates how reliance on SCA tools for custom code security scanning may be insufficient. Examine proof-of-concept code snippets that showcase these evasion methods, and understand the general weaknesses of SCA tools without focusing on specific vendors. Learn why companies should not solely depend on automated analysis and how intentionally placed bugs can bypass detection, potentially compromising software security.