Penetration Testing: Re: Application security eval - methodology

[Gamble <a629w () unb ca>]

> Has anyone published a framework for evaluating the
> security impact of an application (that is, a "black
> box", a binary provided by a vendor)?

While I am not aware of a paper which talks about evaluating the security
impact of a binary,  there are a few good papers out there which talk
about reverse engineering Windows binaries looking for common security
holes (ie: buffer overflows and format string attacks).  

Check out:

HalVar Flake's presentation at the Blackhat conference called "Finding
holes in closed-source software" at
http://www.blackhat.com/html/bh-europe-00/bh-europe-00-speakers.html

and also Dark Spyrit's paper in Phrack 55 called "Win32 Buffer Overflows
(Location, Exploitation and prevention".  you can find it at
http://www.blinky-lights.org/phrack/phrack55/P55-15


Cheers,

-- Jamie