0

I want to start a project, technically based on the code of another project -- a clone. E.g. a forum or an online shop, whatever. I'll buy the code base. But then it's theoretical possible, that the developer/seller is able to manipulate something remote, e.g. export the customer database or just change/delete files with code and make the code useless, if he wants to.

What strategies (maybe best practices) are there to defend oneself in such cases?

Damien Pirsy
  • 25,319
  • 8
  • 70
  • 77
automatix
  • 14,018
  • 26
  • 105
  • 230
  • 1
    Depending on the country, it would probably be against the law for them to do that. – Barmar May 14 '14 at 17:45
  • 3
    Unless you fully review the code, you cannot be sure, and even then there could be all kind of very subtle backdoors in the library, especially if it's big. You either trust the vendor or you don't. – laurent May 14 '14 at 17:46
  • Following on from @Barmar's comment, you might consider only buying in your country, so you have a reasonable change of legal action if you find there's foul play. – halfer May 14 '14 at 17:50
  • 2
    Don't forget the classic: http://cm.bell-labs.com/who/ken/trust.html. Unless you control the operating system, compilers, the compilers that were used to create the compilers, etc. you can never be totally sure. – Barmar May 14 '14 at 17:51
  • @Barmar Don't forget the firmware. – Elliott Frisch May 14 '14 at 17:52

1 Answers1

0

The only viable option is a code review by a person competent in detecting such security flaws. This is by no means a cheap process, nor will there be any guarantee of success.

Even teams of people writing and reviewing code designed to be secure often fail to fill every possible security hole, eventually some hacker finds these holes and exploits them. Take for example the heartbleed bug in OpenSSL.

Regardless of it being the developer who has malicious intent or it being a hacker attacking his otherwise good code the same approaches apply. To prevent your customer DB being downloaded put it on a separate layer with it's own security. If the DB server will only provide the web app with one customer at a time and not provide a list then downloading th whole db is very hard.

Hackers do manage to change and delete code on servers. To mitigate this a tripwire system should be used to detect these changes, then the code can be restored from a simple backup.

Stephen Turner
  • 7,125
  • 4
  • 51
  • 68