The C programming language, commonly used for low-level programming

learn more… | top users | synonyms

6
votes
2answers
3k views

In C, not using 'void' if a function does not accept any argument is a potential vulnerability

In CERT secure coding standard, there is a recommendation that "Always specify void even if a function accepts no arguments". A possible security vulnerability is proposed in it. /* Compile using ...
-1
votes
3answers
152 views

There could be still buffer overflows in ex.: C?

I recently read about the $subject. Q: Why does a programming language has built-in trivial insecurity? Or.. it was just in the old times? How could this be?
2
votes
3answers
1k views

Top 10 dangerous mistakes in C programming? [closed]

What is the top dangerous mistakes in C programming? for example misusing a strcpy causes a stack-overflow and code injection. I'm looking for at least 10 bad programming pattern in C.
3
votes
1answer
288 views

Best option to fuzz a C Network Program [closed]

I have a client/server simple program in C. I want to test the server running on different machine with random inputs. I have looked at 'Bunny-the-fuzzer' but from what I can understand It wont be ...
0
votes
1answer
2k views

Why aren't sophisticated Malware written with .NET [closed]

I've been trying to research malware techniques lately, as malware analysis intrigues me. I've got a pretty heavy background in .NET, and based on my 7+ years in .NET, I feel that I could write a ...
2
votes
1answer
276 views

SSH Protocol classification version exchange messages

I am trying to classify network protocols over network traffic . Now my task is SSH protocol. I read the RFC and know SSH starts with protocol exchange message from both client and server . Format ...
-1
votes
2answers
1k views

Generate openSSL certificates from within C code using commands?

This is an openSSL command for generating a private key and a certificate, openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key The question I have is whether there is some ...
4
votes
1answer
985 views

Is this fprintf statement potentially vulnerable?

Here's the statement: fprintf(stderr, "Some random string\n"). Is it okay not to have a format specifier, such as %s, even though the statement doesn't take any user input? Is it still potentially ...
8
votes
1answer
2k views

How to predict C rand()? [duplicate]

Is there a practical way to predict previous/next C rand() output if i have some of the values? How many values do i need? Do they need to be consequent? If it depends on compiler - for which ...
3
votes
1answer
236 views

how does a return to system allow an attacker to evade a non-executable stack?

I am learning about return to system call attacks for a security class. I understand that in this kind of attack, attackers replace the standard return value for a stack frame with the address of a ...
1
vote
1answer
427 views

Determining the target address in a heap overflow

For a heap overflow to occur and arbitrary code to be executed, the function free() performs the step : hdr->next->next->prev = hdr->next->prev I understand that the address of ...
1
vote
2answers
292 views

What's the secure way to change UNIX permissions on a harcoded file often?

I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
6
votes
2answers
344 views

Using format string to control the flow of a process?

I was cleaning up some code today on the advice of someone I know, and was made aware of the potential for a hacker to gain control over the flow of the process using format strings, particularly the ...
2
votes
1answer
1k views

Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?

Question Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start") ...
7
votes
1answer
301 views

Encryption in an embeddded system

After accepting an answer to my previous question, I am beginning to have doubts. I want to updating pricing information in vending machines by inserting an SD card with new pricing. I have to ...
1
vote
2answers
451 views

Seeking lightweight encryption - shareable between Delphi & C

I want to encrypt a text file in Delphi & decrypt it, line by line, in C on an embedded system which does not have much RAM (so, only one line in RAM at a time). FOSS must be available for both ...
3
votes
1answer
2k views

Stack smashing keep getting segmentation fault

I have a homework assignment to do stack smashing, The exploit code creates a badfile in which the vulnerable file reads and buffer over flow occurs. I have already did the 2 commands below to ...
5
votes
1answer
2k views

“Hello World” example of a Buffer Overflow attack in many programming languages

I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used Ideally (and if ...
3
votes
1answer
680 views

Base64 encode diffences in BCrypt implemenations

I was reading the source code of several BCrypt implementations and found that two common c implementations have a difference in their base64 encoding of for the salt. What is the effect, if any, of ...
0
votes
1answer
309 views

Good reading about windows architecture/reversing [closed]

I have a feeling that I need to get more knowledge about system programming and winapi/windows architecture in particular to be able to understand how lots of exploits work (like those exploiting ...
39
votes
3answers
4k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
7
votes
8answers
444 views

Topics for SecureCoding course in C

So I was asked to put together a syllabus for a series of courses on the basics of secure coding, for a programming team. Though the time constraints are a bit... constraining, I'm working around ...
8
votes
1answer
507 views

PHP 5.3.9 Vulnerability Help

This is one of the first vulnerabilities I've tried to exploit on my own to expand my knowledge of exploits. This is a good summary of the vulnerability. I have been able to control EIP but I'm not ...
1
vote
1answer
347 views

MySQL/CGI: password in C source file unsafe?

Is this line bad practice from a security stance? connect = mysql_real_connect(connection, "host", "user", "password", "database", 0, (const char *)NULL, 0); If so, what solution would you use? ...
1
vote
1answer
367 views

Which software scans software for potential vulnerabilities?

Is there any kind of parser-software-analysis tool that will analyze c code and outputs possible vulnerabilities like buffer oveflows?
5
votes
2answers
329 views

Are more passwords breached via dictionary/bf attacks or via packet-sniffers/key-loggers?

This question has always intrigued me whenever the subject of passwords is brought up. Does anyone have direct experience or a reputable source to answer what percentage of password breaches are ...
2
votes
1answer
438 views

Is there a way to identify the client using SSL Handshake Messages?

I have an SSL Server and it can be connected by two types of Clients, one for which Client Authentication is needed and the other for which Client Authentication is not needed. Is there any mechanism ...
2
votes
2answers
678 views

vulnerable getlogin

I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin). I fail to understand the attack vector ...
3
votes
1answer
3k views

Why do I get “Cannot find bound of current function” when I overwrite the ret address of a vulnerable program?

I want to exploit a stack based buffer overflow for education purposes.There is a typical function called with a parameter from main which is given as input from the program and a local buffer where ...
7
votes
1answer
3k views

OpenSSL RAND_poll 'good enough'

We are using OpenSSL for generating IV's and other random data. We initialize it using RAND_poll and, on Windows, RAND_screen. The question is though, if the seed generated by those methods is good ...
11
votes
2answers
328 views

security implications of NULL dereference

Suppose we have code like this: struct somedata { int a; int b; }; struct somedata *data; /* ... */ data = malloc(sizeof(struct somedata)); data->a = something; Now, as you can see, NULL ...
16
votes
4answers
995 views

Does compiling from sources “kinda” protects from buffer overflow attacks?

While discussing buffers overflows, somebody told me that compiling your own binary for an application (with specific compilation flags) instead of using the "mainstream binary" makes it more ...
10
votes
1answer
2k views

Howto seed the PRNG in OpenSSL properly?

I am creating an application which runs on a mobile node with Ubuntu, which does not generate enough entropy bytes to the /dev/random, and does not always stay connected on the Internet to use typical ...