{"id":32817,"date":"2020-01-16T15:00:37","date_gmt":"2020-01-16T15:00:37","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=90433"},"modified":"2020-01-16T15:00:37","modified_gmt":"2020-01-16T15:00:37","slug":"introducing-microsoft-application-inspector","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/introducing-microsoft-application-inspector\/","title":{"rendered":"Introducing Microsoft Application Inspector"},"content":{"rendered":"

Modern software development practices often involve building applications from hundreds of existing components, whether they\u2019re written by another team in your organization, an external vendor, or someone in the open source community. Reuse has great benefits, including time-to-market, quality, and interoperability, but sometimes brings the cost of hidden complexity and risk.<\/p>\n

You trust your engineering team, but the code they write often accounts for only a tiny fraction of the entire application. How well do you understand what all those external software components actually do? You may find that you\u2019re placing as much trust in each of the thousands of contributors to those components as you have in your in-house engineering team.<\/p>\n

At Microsoft, our software engineers use open source software to provide our customers high-quality software and services. Recognizing the inherent risks in trusting open source software, we created a source code analyzer called Microsoft Application Inspector<\/a> to identify \u201cinteresting\u201d features and metadata, like the use of cryptography, connecting to a remote entity, and the platforms it runs on.<\/p>\n

Application Inspector differs from more typical static analysis tools in that it isn\u2019t limited to detecting poor programming practices; rather, it surfaces interesting characteristics in the code that would otherwise be time-consuming or difficult to identify through manual introspection. It then simply reports what\u2019s there, without judgement.<\/p>\n

For example, consider this snippet of Python source code:<\/p>\n

\"Image<\/a><\/p>\n

Here we can see that a program that downloads content from a URL, writes it to the file system, and then executes a shell command to list details of that file. If we run this code through Application Inspector, we\u2019ll see the following features identified which tells us a lot about what it can do:<\/p>\n