C and C++ Secure Coding
4-day course
Syllabus
C and C++ Secure Coding 4-Day Course
Course description
Secure Programming is the last line of defense against attacks targeted toward our systems.
This course shows you how to identify security flaws & implement security countermeasures in
different areas of the software development lifecycle and apply these skills to improve the
overall quality of the products and applications. Using sound programming techniques and best
practices shown in this course, you can produce high-quality code that stands up to attack.
The course covers major security principles in C/C++ and software vulnerabilities caused be
unsecure coding. The objectives of the course are to acquaint students with security concepts
and terminology, and to provide them with a solid foundation for developing software using the
best practices in C/C++. By course completion, students should be proficient in secure
programming and have learnt the basics of security analysis and design. Students should then
be able to develop, design and maintain applications using security methods and techniques for
the C/C++ language.
Target audience
Members of the software development team:
C / C++ Developers
Designers & Architects
Prerequisites
Before attending this course, students should be familiar with:
C/C++ language
Background in memory management
Background in OS mechanisms
1|P age
Course topics
Day 1
Buffer Overflows and Code Injections
Stack Overflows attacks
Heap overflows attacks
Array indexing attacks
Format strings attacks
Unsafe API’s
Safer API’s
Stack guards
Compiler checks
Better ways to manipulate strings and buffers.
Integer Overflows
Int / Double overflows
Integer conversion rules
Signed and unsigned problems
Safe integer usage
Enforcing limits on integer values
Preventing lost or misinterpreted data due to conversion
Using secure integer libraries
Safe API
Dangerous and banned APIs
Real-World Risks
Using safe API’s
The ‘n’ Functions
Detecting Dangerous APIs
Alternatives
StrSafe
2|P age
Secure Memory Usage
Secure memory handling
Erasing Data
Secure pointer usage
Memory Dumps
Use smart pointers for resource management
Ensure pointer arithmetic
Avoid null pointer dereferencing
Ensure sensitive data is not paged to disk
LAB
Hands on lab #1
Day 2
Input Validation
What is considered Input?
Common Errors - Unbounded string copies, Null-termination errors, Truncation, Write
outside array bounds, Off-by-one errors, Improper data sanitization
Black List VS. White List Validation
ATTACK SCENARIO: Canonicalization
String Manipulation and Comparison
Data Type Conversion
Regular Expressions
Validation practices - Validating format strings, Validating buffer input, Validating
filenames & URLs, Validating emails
Secure File Handling
Directory Traversal attacks
File canonicalization attacks
Creating files with correct ACLs
Ensure files are closed when no longer needed
Insecure usage of shared directories
3|P age
Application Denial of Service vulnerabilities
Application / OS crash
CPU starvation
Memory starvation
File system starvation
Resource starvation
Triggering high network bandwidth
User level DOS
Exploiting a specific vulnerability to cause DoS
LAB
Hands on lab #2
Day 3
Network Security
Introduction to Networking
Network attacks
Insecure Services
Application Layer Threats and attacks
Traffic Sniffing
Traffic Manipulation
Man-in-the-Middle
Avoiding Server Socket Hijacking
Firewall Friendly Application
Encryption in C/C++
Introduction to cryptography
ATTACK SCENARIO: Weak Encryption
Symmetric encryption
Asymmetric encryption
Transport Level Encryption
Storage Level Encryption
Cryptographic API's – CryptoApi, DPAPI, Crypro++
4|P age
Authentication & Authorization
Authentication scenarios
Common mistakes
Attack scenario: brute force
Authentication protocols
Attack scenario: weak passwords
Authorization models
Access Control List (ACL)
Role Based Access Control (RBAC)
Attack scenario: exposed functionality via anonymous authentication
LAB
Hands on lab #3
Day 4
Thread safety
Concurrency & Race conditions
Mutual Exclusion
Deadlock
Time of Check/Time of Use (TOCTOU)
Files as Locks
Symbolic link attacks
Temporary files
Handling the race window
controlling race objects
using atomic operations
Logging & Error handling
How to use exceptions properly
Process uncaught and unexpected exceptions
Prevent sensitive information disclosure via errors
Declare new exception classes for security
Events you should log
Events you should not log
Log integration with exception management
5|P age
Secure Coding Tips
Prefer Streams to C-Style Input and Output
Do not replace secure functions with less secure functions
Avoid defining macros
Do not ignore values returned by functions or methods
Secure defaults and initializations
The least privilege principle
The defense in depth principle
The segmentation principle
Avoiding hard coded secrets
Use Static Code Tools
Integrating security into the development lifecycle
Anti-reversing
Eliminate “symbolic info”
Obfuscate the program
Code Encryption
Use anti-debugger tricks
Code Checksums
Confusing a Disassembler
Inlining and Outlining sensitive code
Interleaving Code
Existing tools
LAB
Hands on lab #4
6|P age
