Product Security Glossary

Binary Analysis

What is binary code? 

Binary code makes up the computer programs that tell a computer what to do.  Computer programs can be written in a variety of languages, such as C, Java, or sometimes even Assembly Language.  These programs are then compiled into the binary files that get installed on a computer.  But, as we all know, human programmers aren’t perfect, and can sometimes let security-related bugs slip into a program.  

What is binary analysis?

Binary analysis, also known as “binary code analysis”, is a useful tool for vulnerability testing and for making threat assessments.  It can be performed on stripped binary program files, which means that it can be done without having access to the source code of the program in question.  This also means that sensitive information is not sent to the binary code analysis, and that this is also one of the view point of a potential attacker.  Although this may seem like “reverse engineering”, it really isn’t.  Rather, with binary analysis, you’ll create a Software Bill of Materials (SBOM), and attempt to create a model of data flows, data types, and control paths.  You’ll then analyze that model to detect any recognizable security flaw and vulnerabilities, and then put your findings into a vulnerability report. 

How is binary analysis useful?

By decomposing and disassembling a program’s binary file, binary code analysis can find known, recognizable patterns for various types of security vulnerabilities.  These include:

  • Injection attack vectors
  • Cross-site scripting
  • Buffer overflows
  • Unhandled error conditions

With some programming languages, such as C, it’s extremely easy for a programmer to accidentally create one of these conditions in programming code.  Bad actors can use any of these conditions to inject malicious commands into a running program. 

Binary code analysis can also be used to find deliberate injections of malware, such as rootkits, back doors, and trojans. Additionally,  Binary code analysis can locate non secure libraries, missing patches, and known vulnerabilities. 

Are there tools for binary analysis?

Various vendors offer different types of tools for binary code analysis.  There are two general types of binary code analysis tools, which should be used together. 

  • Software Composition Analysis, or SCA, is primarily used to scan open-source software.  That’s because analyzing open source software requires techniques that are different from those used for analyzing proprietary software.  It’s also good for identifying open-source software licenses in order to ensure license compliance. 
  • Static Application Security Testing, or SAST, is better for proprietary software.  By including a manual inspection step, SAST tools can help you effectively find vulnerability patterns that might be too subtle for other tools. 

Who can use binary code analysis?

Software developers can use binary analysis tools as part of the software development process.  This way, security bugs can be caught and corrected before the software gets released for use.  Businesses can also use binary analysis as part of the software procurement process.  Identifying security bugs before software is deployed can prevent much heartache for business owners.