Hacker News Reader

I am curious what network detection could be done to detect this sort of thing. Clearly the code needed to make outbound connections to hosts.

Some thoughts: if there is an encoded sub domain, flag this as suspicious.

Any code that uses a function to decode a base64 encoded string should be a red flag.

Any newly created thread code should be detected and checked most carefully.

Any others people can think of?

View on HN

> what network detection could be done to detect this sort of thing. Clearly the code needed to make outbound connections to hosts.

Renting space that shares a netblock with a trusted host could make that more difficult.

Any decent static code analysers should be able to detect things like this (catch all’s statements, base64 encoding etc), I am surprised none seem to be used for production code.

Is SCA often set up to run on the fully built end result running on the production machine? I’ve generally seen them as pre-merge-to-source-control.

Reply on news.ycombinator.com