Codebase Scanning for Vulnerable Cloud Resource Dependencies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing code analysis solutions fail to adequately address the dynamic nature of cloud resources referenced in codebases, making them susceptible to subdomain hijacking and cyberattacks.
Innovation Solution
A method and system for scanning codebases to identify dependencies on vulnerable cloud resources by flagging untrusted resources that cannot be resolved into an IP address and are registerable with a DNS server, raising alerts for potential cyberattack vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing code analysis solutions are used to analyze codebases, then vulnerabilities in open source dependencies can be detected, but the dynamic nature of cloud resources referenced in codebases cannot be adequately addressed
Solution Approach 1:
The patent implements dynamic verification of cloud resources by checking DNS resolution status and registration availability at the time of analysis. The system determines whether a cloud resource is currently resolvable and registerable, transforming static dependency analysis into dynamic assessment that reflects the actual state of cloud resources in the environment.
Solution Approach 2:
The patent introduces DNS resolution and registration status as intermediary verification mechanisms between the codebase dependencies and the actual cloud resources. By using DNS lookup and registration checks as intermediaries, the system can determine the current accessibility and vulnerability state of cloud resources without directly accessing them.
2Adaptability or versatility
If cloud resources are referenced in codebases without verification, then development flexibility is maintained, but subdomain hijacking and cyberattacks become possible
Solution Approach 1:
The patent performs preliminary verification of cloud resource accessibility and registration status before the codebase can be deployed or executed. By checking DNS resolution and registration availability in advance, the system prevents vulnerable cloud resources from being activated, blocking subdomain hijacking attempts before they can occur.
Solution Approach 2:
The patent applies preliminary anti-action by actively detecting and preventing the activation of untrusted cloud resources. The system identifies resources that are not currently resolvable or are markable for registration, and blocks their use in the codebase, thereby preemptively counteracting potential subdomain hijacking and cyberattack vectors.
3Reliability
If comprehensive verification of cloud resources is performed, then security against cyberattacks is improved, but analysis time and computational resources increase
Solution Approach 1:
The patent applies partial verification by focusing DNS resolution and registration status checks only on cloud resources that are actually referenced in the codebase, rather than verifying all possible cloud resources. This selective approach provides adequate security coverage for relevant resources while minimizing unnecessary verification time and computational overhead.
Data Source
AI summary
Vulnerable cloud resource dependencies are identified in codebases. A codebase is scanned for references to one or more cloud resources. Untrusted cloud resources are identified by comparing the referenced cloud resources to an inventory of trusted cloud resources. An untrusted cloud resource is detected to be vulnerable to a cyberattack in response to determining that a subdomain of the untrusted cloud resource cannot be resolved to an Internet Protocol (IP) address by a Domain Name System (DNS) server and can be registered with a cloud service provider.