I had some software created for me by a coder overseas. I'm a little suspicious since the software is executable. I started thinking about the possibility that they could have binded a key logger to the application they made for me or any kind of software with malicious intent. How can I find out?
For reference, when you have someone create a custom program for you, you should insist on getting the source code -- all of it, in a state where you (or someone you trust) can recompile it with the proper tools. That's the only way to be anywhere close to certain of what any binary exe does, short of learning assembler language.
If you contracted with them to have it done, your best bet is to get the source. If you paid for it, your contract should read this way, anyway. Then you just inspect the code yourself before you use it.
If there's no way to get source, it really comes down to a trust issue. If you don't trust them, you probably should find an alternative solution. And, for the love of all that's FSM, DON'T release a product based upon that code. Remember, depending upon where you are and who your customers are, YOU can end up shouldering the liability for any damage that system does.
Can't believe no one has mentioned this yet: Run a virus scanner, it is not easy to fool their heuristics.
Aside from that, demand the source code and (have someone) check it over.
You should have contracted to get the source code and built it yourself after auditing the source code.
Here are a few ideas:
- Run it with process monitor and see if it writes to disk, the registry, etc.
- Profile it via depends and see if it loads any strange dlls you didn't expect.
- Run it in a virtual machine and see what system changes are made.
Make sure you have a good anti-virus running.
What language was the code written in? If it was written in .NET, for example, you could Reflector to disassemble and take a look at what the code actually does.