TrojanSourceFinder | Help Find Trojan Source Vulnerability In Code

TrojanSourceFinder helps developers detect “Trojan Source” vulnerability in source code.

Trojan Source vulnerability allows an attacker to make malicious code appear innocent. In general, the attacker tries to lure by passing his code off as a comment (visually). It is a serious threat because it concerns many languages. Projects with multiple “untrusted” sources could be concerned

Detect evil :mag_right: · Track evil :eyes: · Trojan Source :question:

Install

With go

> Via go install

go install github.com/ariary/TrojanSourceFinder/cmd/[email protected]

Make sure $GOPATH is in your $PATH

> From source

git clone https://github.com/ariary/TrojanSourceFinder cd TrojanSourceFinder make before.build make build.tsfinder

If the command make build.tsfinder failed, try:

env GOOS=target-OS GOARCH=target-architecture go build -o tsfinder cmd/main.go

With curl

> From release

curl -lO -L https://github.com/ariary/TrojanSourceFinder/releases/latest/download/tsfinder && chmod +x tsfinder

Detect Trojan Source

> Help the detection of Trojan source for manual code review or with CI/CD pipelines (Unicode bidirectional characaters)

To detect Trojan source in file or directory :

tsfinder [path]

Detect only in text file

> Source code files are likely text files. Withdraw them for scan could help to rule out false positives

tsfinder -t [path]

Add -v help to see which file has been skipped by scan.

Go further (Homoglyph)

Trojan Source is not new and isn’t the only hazard. Another one is “Homoglyph”.(Kezako?)

tsfinder help detecting them with homoglyph command:

tsfinder homoglyph [filename] [flags]

You could see if there is a sibling (ie word with same “skeleton”) for the homographs found in path using the flag --sibling:

tsfinder homoglyph [filename] --sibling [path]

Functionality under development, mainly depending on other project

Visualize Trojan Source

> Visualize how the code is really interpreted by machines/compiler

tsfinder is deliberately not very verbose. By default, it will only output if Trojan Source code has been detected. To have more verbosity and visualize the dangerous line add the flag -v.

To better see where Trojan Sources were, you could enable colored output with -c flag (also useful with directory scan):

tsfinder -c -v

Demo

demo

Homoglyph

demo

Alternative

As mentioned by @ioah86 here, trojan source could also been detected w/ a one liner using grep.

The big difference is the output format and the exit status code (tsfinder exit with status code 0 if no Trojan source has been found, 1 otherwise; the opposite for grep)

Also, this one-liner does not resolve the homoglyph issue

Goal tsfinder grep one-liner
Scan all files + show lines tsfinder -v . grep -arE
Scan only on human-readable files tsfinder -t . grep -IrE
Exit with status code 1 if found default [one-liner] && exit 1 || exit 0
Scan only on human-readable files DISCOURSE_PLACEHOLDER_22 DISCOURSE_PLACEHOLDER_23
Exit with status code 1 if found default DISCOURSE_PLACEHOLDER_24
Exit with status code 1 if found default DISCOURSE_PLACEHOLDER_24
Scan only on human-readable files DISCOURSE_PLACEHOLDER_22 DISCOURSE_PLACEHOLDER_23
Exit with status code 1 if found default DISCOURSE_PLACEHOLDER_24

GitHub:

1 Like
Friendly Websites

https://igg-games.com/ https://pcgamestorrents.com/ https://pirateiro.com/ ettvdl.com https://crackingpatching.com/ https://glodls.to/ https://prostylex.org/ https://haxnode.com/ https://www.novahax.com/ https://www.sadeempc.com/ freecoursesonline.me ftuapps.dev