While one started as a way to map open-source components for license compliance purposes, the other started as a penetration tester’s tool, helping white-hat hackers analyze binary files of embedded systems.
Any developer looking to use open-source code that may help propel a project forward can easily do so with a basic Google search and copy/paste action. Because this introduced IP ownership and commercial implications for software vendors, a scramble for Software Composition Analysis tools is underway. These solutions started as a way to map open-source components for license compliance purposes. They use access to developer’s source code and build mapping files to detect all possible packages used in a build for license compliance purposes.
The players in the category can generate composite license analysis reports and, as cyber-attacks have picked up, they have added listing of CVEs attached to the various packages that were potentially part of a build.
Binary Analysis, on the other hand, started as a penetration tester’s tool, helping white-hat hackers analyze IoT (then known as “embedded”) binary files for possible misconfigurations and vulnerabilities.
As cyber-attacks on IoT devices intensified, the need by developers and defenders for dedicated tools grew.
Professionals in IoT product Security and Security operations found a great solution in Binary Analysis tools, which were originally built with an attacker’s mindset and fitted a defender’s needs perfectly.
Binary Analysis tools give the Product Security engineer a software “Bill of Materials” (SBOM): precise lists of components that are in the product’s final build – not just in the source code repository – eliminating the need to validate false-positive findings.
Furthermore, these tools search for, and find, important misconfigurations that affect an attacker’s ability to pwn the device; these problematic configurations cannot be detected before the binary is built and available for analysis.
Binary Analysis is particularly useful for supply chain scenarios, where some parts of the final build come in object form, rather than as source code. The analysis allows developers to find errors and misconfigurations in 3rd-party software modules (both open source and proprietary) early in the process, and allows for fixing them without affecting project timelines.
Teams that are developing server-side software may also find value in Binary Analysis tools; however, those teams may also be well-served by traditional Software Composition Analysis tools.
Sign up for Karamba’s free binary analysis and CVEs monitoring.
