Scribd
Upload
29 views

Secure Coding: Lecture Deliver by Sidra Siddiqui

The document discusses secure coding practices for C and C++. It defines key terms like secure coding, vulnerabilities, exploits, and mitigations. It explains common problems that can lead to vulnerabilities like buffer overflows from issues with C-style strings like unbounded copies or missing null terminators. It notes secure coding takes more time but helps avoid bugs and vulnerabilities during development rather than fixing later.

Uploaded by

john john
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
29 views

Secure Coding: Lecture Deliver by Sidra Siddiqui

The document discusses secure coding practices for C and C++. It defines key terms like secure coding, vulnerabilities, exploits, and mitigations. It explains common problems that can lead to vulnerabilities like buffer overflows from issues with C-style strings like unbounded copies or missing null terminators. It notes secure coding takes more time but helps avoid bugs and vulnerabilities during development rather than fixing later.

Uploaded by

john john
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 15

Secure Coding

Lecture Deliver by Sidra Siddiqui


Secure coding :
• “Secure coding is the practice of developing computer software in
a way that guards against the accidental introduction of security
vulnerabilities.”
• “Programming in a way as to avoid bugs and possible security
vulnerabilities at the time of development, rather than reviewing
and fixing code after the fact.”
• Developing software with the motive that if some one gets access
even trough network or open port it will at least not make it to
behaviours abnormally.
• Aim is to make more robust software.
Point of Silence!!!
• “We wouldn’t have to spend so much time and effort on network
security if we didn’t have such bad software security.”
Bruce Schneider
• “Malicious hacker’s don’t create security holes; they simply exploit
them. Security holes and vulnerabilities – the real root cause of the
problem – are the result of bad software design and
implementation.”
John Viega & Gary McGraw
Problem/ Unfortunate Luck :
• Secure code often takes a performance hit – i.e. the software runs
about 1/3 slower – something many users don’t want to tolerate.
• Writing secure code also takes a lot more time – hence,
development costs are higher than usual.
• Consequently, the longer development times and the longer running
times discourage developers from writing secure code.
Security Concepts:
•Software Defects:
• A software defect is the encoding of a human error into the software,
including omissions.
Security Flaw:
• A security flaw is a software defect that poses a potential security risk.
• Eliminating software defects eliminate security flaws.
• vulnerability
• A vulnerability is a set of conditions that allows an attacker to violate an
explicit or implicit security policy.
Exploit:
• An exploit is a piece of software or technique that takes advantage of a security
vulnerability to violate an explicit or implicit security policy.

• Vulnerabilities in software are subject to exploitation.


Mitigation:

• Mitigations are methods, techniques, processes, tools, or runtime libraries that


can prevent or limit exploits against vulnerabilities.
Scope of this lecture :
• Since the most commonly used language is C++ and C we will consider
them.
• Since there are so many dimensions which comes under
vulnerabilities for the purpose of brevity we will consider the most
common one.
• Be able to identify certain types of bugs/vulnerabilities in C/C++
source code.
• Identify the correct way to avoid these bugs
Problem of C++ and C:
• Error-prone, because they are intended to be lightweight and to
produce a small code print.
• Problems arise from an rough understanding of the semantics of
logical concepts and how they translate into machine-level
instructions.
• Unfortunate behavior on out of bound , Null pointer dereferencing ,
lack of data sanitization: type mismatching .
• The secure is compromised because these and similar other behaviors
can be exploited.
Common Standards for C and C++
Common Problem 01 : Buffer Over flow
• A buffer overflow occurs when data is written outside of the
boundaries of the memory allocated to a particular data structure
16 Bytes of Data
16 Bytes of Data

Source
Source
Memory
Memory
Copy
Copy
Operation
Destination Operation
Destination
Memory
Memory

Allocated Memory (12 Bytes) Other Memory


Allocated Memory (12 Bytes) Other Memory
01Problem :Buffer Overflows
• Buffer overflows occur when data is written beyond the boundaries
of memory allocated for a particular data structure.
• Caused when buffer boundaries are neglected and unchecked
• Buffer overflows can be exploited to modify a
• variable
• data pointer
• function pointer
• return address on the stack
How it happened 
• One assumes all inputs will be smaller than a certain size and the
Buffer is created to be that size, then an anomalous transaction which
produces more data and cause it to write past the end of the Buffer.
• Successful exploits can overwrite the return address on the stack
allowing execution of arbitrary code on the targeted machine. Leads
to stack over flow.
Problem 01 : BOF : Scenario 01 :C-Style
Strings
• Strings are a fundamental concept in software engineering, but they are not a built-in type in
C or C++.

length
• C-style strings consist of a contiguous sequence of characters terminated by and including the
first null character.
• A pointer to a string points to its initial character.
• String length is the number of bytes preceding the null character
• The string value is the sequence of the values of the contained characters, in order.
• The number of bytes required to store a string is the number of characters plus one (x the size
of each character)
Common String Manipulation Errors
• Programming with C-style strings, in C or C++, is error prone.
• Common errors include
• Unbounded string copies
• Null-termination errors
• Truncation
• Write outside array bounds
• Off-by-one errors
• Improper data sanitization

You might also like