Outsourced software developer - Revision history

KirstenS at 19:39, 14 April 2009

2009-04-14T19:39:03Z

KirstenS at 23:36, 7 April 2009

2009-04-07T23:36:27Z

KirstenS at 12:29, 5 March 2009

2009-03-05T12:29:04Z

KirstenS: /* Related Threats */

2008-09-19T12:03:32Z

‎Related Threats

KirstenS: /* Related Attacks */

2008-09-19T12:03:14Z

‎Related Attacks

KirstenS at 18:19, 6 September 2008

2008-09-06T18:19:44Z

KirstenS at 21:33, 5 September 2008

2008-09-05T21:33:10Z

Jeff Williams at 16:11, 16 August 2006

2006-08-16T16:11:58Z

OWASP: /* Description */

2006-08-12T18:25:47Z

‎Description

OWASP at 18:25, 12 August 2006

2006-08-12T18:25:33Z

New page

{{Template:Threat}}

==Description==

Outsourced software developers are hired to write code to a specification provided by the procuring company. Their deliverable may include source code, but is sometimes only a compiled version of the application.

A malicious developer is one of the most difficult threats to deal with, as it is extremely difficult to identify malicious code. A talented attacker will make attacks look exactly like an inadvertent error for plausible deniability. In addition, malicious code may be obfuscated to prevent easy detection. Some techniques include spreading an attack throughout a software baseline, using inheritance and class loading tricks to hide calles, and even formatting tricks.

An outsourced software developer may have no ties with the procuring company and may see an opportunity to steal information or money via a software attack.

==Examples==

* Java software developer
* SQL developer
* Mainframe developer

==Related Threats==

* [[Internal software developer]]

==Related Attacks==

* [[Logic/time bomb]]
* [[Backdoor attack]]
* [[Salami attack]]

[[Category:Attack]]

@@ Line 2: / Line 2: @@
 <!--Marked for deletion because it's a duplicate-->
 <br>
-[[Category:OWASP ASDR Project]]
+ #REDIRECT [[::Category:Vulnerability]]
 ==Description==

@@ Line 3: / Line 3: @@
 <br>
 [[Category:OWASP ASDR Project]]
 ==Description==

@@ Line 1: / Line 1: @@
 {{template:CandidateForDeletion}}
-[[Category:FIXME|Marked for deletion because it's a duplicate]]
+<!--Marked for deletion because it's a duplicate-->
 <br>
 [[Category:OWASP ASDR Project]]

@@ Line 1: / Line 1: @@
-{{Template:Threat}}
+{{template:CandidateForDeletion}}
 <br>
 [[Category:OWASP ASDR Project]]

← Older revision		Revision as of 21:33, 5 September 2008
Line 1:		Line 1:
	{{Template:Threat}}		{{Template:Threat}}
		+	<br>
		+	[[Category:OWASP ASDR Project]]
		+	[[ASDR Table of Contents]]__TOC__

	==Description==		==Description==

@@ Line 19: / Line 19: @@
 * Mainframe developer
-==Related Threats==
+==Related [[Threat Agents]]==
 * [[Internal software developer]]
 ==Related Attacks==

@@ Line 25: / Line 25: @@
 ==Related Attacks==
 * [[Backdoor attack]]
 * [[Salami attack]]

← Older revision		Revision as of 16:11, 16 August 2006
Line 24:		Line 24:
	* [[Backdoor attack]]		* [[Backdoor attack]]
	* [[Salami attack]]		* [[Salami attack]]
−
−	~~[[Category:Attack]]~~

@@ Line 5: / Line 5: @@
 Outsourced software developers are hired to write code to a specification provided by the procuring company. Their deliverable may include source code, but is sometimes only a compiled version of the application.
-A malicious developer is one of the most difficult threats to deal with, as it is extremely difficult to identify malicious code. A talented attacker will make attacks look exactly like an inadvertent error for plausible deniability. In addition, malicious code may be obfuscated to prevent easy detection. Some techniques include spreading an attack throughout a software baseline, using inheritance and class loading tricks to hide calles, and even formatting tricks.
+A malicious developer is one of the most difficult threats to deal with, as it is extremely difficult to identify malicious code. A talented attacker will make attacks look exactly like an inadvertent error for plausible deniability. In addition, malicious code may be obfuscated to prevent easy detection. Some techniques include spreading an attack throughout a software baseline, using inheritance and class loading tricks to hide calls, and even formatting tricks.
 An outsourced software developer may have no ties with the procuring company and may see an opportunity to steal information or money via a software attack.