We have been for the last few months hard at work developing a new scan engine to identify new classes of vulnerabilities. The new scan engine is capable of identifying SQL injections, intent hijacking, insecure random seed, insecure cryptography etc.

The new scan engine uses taint propagation and it was rewritten multiple times to enhance performance and resource consumption allowing for an increased application coverage.

It is already available and all of Ostorlab users can already scan their applications for security issues to fix. The scanner is still in beta mode and more work will be poured in the next few weeks to enhance reporting and correct false positives and false negatives. We have however already had great results identifying a huge number of high risk vulnerabilities (https://www.ostorlab.co/report/scan/1/)

We will also follow up with new blog post to share our journey, from what is taint analysis and what advantages does it provide and also delve into many of the software engineering issues we faced, like path explosion, static analysis and false positives, C++ to Python binding and how to push Python performance.