up vote 4 down vote favorite
share [g+] share [fb]

I had some software created for me by a coder overseas. I got a little paranoid since the software is executable. I started wondering if they could possibly have binded a key logger to the application they made for me or any kind of software with malicious intent. How could I find out?

link|improve this question
1  
You could try hooking up a packet sniffer, and see if the program is sending TCP or UDP packets. Beyond that, I would say that it's important to have a trustworthy relationship with your overseas partners. – Robert Harvey May 5 '10 at 21:29
@closers: If you are contracting someone overseas to write software for you, how is this SuperUser related? – Robert Harvey May 5 '10 at 21:30
1  
It's asking how to tell whether there is a key logger in a piece of software, which isn't a programming question. The fact that the software was written for the OP by contract is mostly irrelevant. – David Zaslavsky May 5 '10 at 21:33
What sort of software? – David Thornley May 5 '10 at 21:37
feedback

migrated from stackoverflow.com May 5 '10 at 22:50

This question came from our site for professional and enthusiast programmers.

6 Answers

up vote 9 down vote

For reference, when you have someone create a custom program for you, you should insist on getting the source code -- all of it, in a state where you (or someone you trust) can recompile it with the proper tools. That's the only way to be anywhere close to certain of what any binary exe does, short of learning assembler language.

link|improve this answer
feedback
up vote 3 down vote

If you contracted with them to have it done, your best bet is to get the source. If you paid for it, your contract should read this way, anyway. Then you just inspect the code yourself before you use it.

If there's no way to get source, it really comes down to a trust issue. If you don't trust them, you probably should find an alternative solution. And, for the love of all that's FSM, DON'T release a product based upon that code. Remember, depending upon where you are and who your customers are, YOU can end up shouldering the liability for any damage that system does.

link|improve this answer
feedback
up vote 1 down vote

You should have contracted to get the source code and built it yourself after auditing the source code.

link|improve this answer
feedback
up vote 1 down vote

Can't believe no one has mentioned this yet: Run a virus scanner, it is not easy to fool their heuristics.

Aside from that, demand the source code and (have someone) check it over.

link|improve this answer
feedback
up vote 0 down vote

Here are a few ideas:

  • Run it with process monitor and see if it writes to disk, the registry, etc.
  • Profile it via depends and see if it loads any strange dlls you didn't expect.
  • Run it in a virtual machine and see what system changes are made.

Make sure you have a good anti-virus running.

link|improve this answer
2  
If you don't trust it, I'd favor running it in a VM without any network access - that way, your machine isn't at risk, and there's no chance it can call home with any useful information. – rwmnau May 5 '10 at 21:32
1  
A black-box analysis is never sufficient examination of a system. Unless you like three-kiloton explosions: en.wikipedia.org/wiki/Siberian_pipeline_sabotage. (The malicious logic was designed to evade testing and only come out of its sleeper status when it was in full operation.) – Anonymous May 5 '10 at 21:35
feedback
up vote 0 down vote

What language was the code written in? If it was written in .NET, for example, you could Reflector to disassemble and take a look at what the code actually does.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard