Skip to content
ECQ Logo

Application Security Analysis

Compromise AssessmentApplication Security AnalysisSecure Code ReviewCryptography Service
> 0xC81C368A | ASA_0
> 0xCEE2F904 | ASA_1
> 0xCA2FF8FE | ASA_2
> 0xD1296677 | ASA_3
> 0x08CB6AD7 | ASA_4
> 0x1C2DF782 | ASA_5
> 0x4C3C5DC3 | ASA_6
> 0x87DB7BBC | ASA_7
> 0xCF6FEE21 | ASA_8
> 0x135E8AEA | ASA_9
> 0x1AE602BF | ASA_10
> 0x2470BCEC | ASA_11
> 0xA183F2A7 | ASA_12
> 0xCD05F9A7 | ASA_13
> 0x68068844 | ASA_14
> 0x4C53637E | ASA_15
> 0x110F5346 | ASA_16
> 0x348AF9E2 | ASA_17
> 0xBE49969D | ASA_18
> 0x72CEAE6D | ASA_19
Application Security Analysis Background

Reverse engineer application to understand internal structure

Fuzz and inject malformed data to discover security issues

Write exploit or proof-of-concept code to validate the vulnerability

Software vulnerability is responsible for a majority of security breaches. The unstoppable growth of digital transformation makes software security even more important as hackers constantly attack and exploit vulnerable applications to infiltrate an organization. Despite its criticality, software are still buggy and vulnerable to all kind of attacks owing to the lack of software quality assurance and testing.

In contrary to Secure Code Review service where source code is required for security analysis, ECQ offers Application Security Analysis service to test closed source or proprietary software for potential security issues. The service is offered from a Black Box point of view where no source code or internal structure of the software is provided.

The following describes three major activities that are normally involved.

ECQ carries out fuzzing and fault injection against various interfaces of the targeted application such as protocols, input parameters, or file formats to trigger crashes or unusual responses. Software crashes are then debugged and analyzed for reproducibility and exploitability.

Reverse engineer is the process of decomposing or disassembling the application to understand the inner working of its components, structures, functions, and data flows. This process is important for ECQ to analyze and decide whether a potential crash is actually a security vulnerability.

For high risk security vulnerability that would result in serious impact such as arbitrary code execution or privilege escalation, ECQ Consultants write Proof-of-Concept (PoC) and develop exploit to validate the vulnerability. Through this exercise, ECQ can assert the true existence of the vulnerability and the difficulty and prerequisite for successful exploitation.