In computing, C (/ˈsiː/, like the letter C) is a general-purpose programming language initially developed by Dennis Ritchie at bell labs Its design provides constructs that map efficiently to typical machine instructions

learn more… | top users | synonyms

1
vote
2answers
246 views

What's the secure way to change UNIX permissions on a harcoded file often?

I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
1
vote
3answers
245 views

OpenSSL encrypting small packets bandwidth overhead

I have an c/c++ program used for encrypting data for communicating between two ends. Encryption is done using OpenSSL (0.9.8d-fips, Sep 2006). Think it'll be worthy to mention that I'm not much ...
1
vote
2answers
305 views

Seeking lightweight encryption - shareable between Delphi & C

I want to encrypt a text file in Delphi & decrypt it, line by line, in C on an embedded system which does not have much RAM (so, only one line in RAM at a time). FOSS must be available for both ...
1
vote
1answer
313 views

Which software scans software for potential vulnerabilities?

Is there any kind of parser-software-analysis tool that will analyze c code and outputs possible vulnerabilities like buffer oveflows?
1
vote
2answers
100 views

Is `arc4random` secure enough?

I need to generate many many initialization vectors and session keys in C++ code. I am wondering if arc4random is up to the task. Last I heard, there are many weaknesses in the RC4 cipher. Should I ...
1
vote
1answer
389 views

Determining the target address in a heap overflow

For a heap overflow to occur and arbitrary code to be executed, the function free() performs the step : hdr->next->next->prev = hdr->next->prev I understand that the address of ...
1
vote
1answer
19 views

Expand user login in Path - Filter malicious values

I have a function that takes a pathname and substitutes every occurrence of '%u' with a given String. For my scenario this given String is the login that a user/attacker enters via ssh during ...
1
vote
1answer
95 views

Examples of software web clients (web browsers, IM clients, etc) written in “secure” / managed languages

After reading this article ("Everything is broken" by Quinn Norton) I was about to ask a question similar to this one (Why are security-crucial software written in unsafe languages?)... but actually I ...
1
vote
1answer
1k views

Starting a new shell in a strcpy exploit using buffer overflow

I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from: #include <string.h> void myfunction(char *arg); int main(int argc, char **argv) { ...
1
vote
0answers
76 views

Problem in understanding Blakley's Secret Sharing Scheme

I need to implement Blakley's Secret Sharing Scheme. I have read below mentioned two research papers but still unable to understand how to implement it. 1. Safeguarding cryptographic keys 2. Two ...
0
votes
1answer
1k views

Why aren't sophisticated Malware written with .NET [closed]

I've been trying to research malware techniques lately, as malware analysis intrigues me. I've got a pretty heavy background in .NET, and based on my 7+ years in .NET, I feel that I could write a ...
0
votes
1answer
76 views

libraries alternative to gcc stack-protector / fortity source feature on linux

is there external library/approach/whatever to add canary protection (stack-protector equivalent) extra buffer boundary check (fortity source equivalent) on a C software without using glibc / ...
0
votes
1answer
277 views

Good reading about windows architecture/reversing [closed]

I have a feeling that I need to get more knowledge about system programming and winapi/windows architecture in particular to be able to understand how lots of exploits work (like those exploiting ...
0
votes
0answers
22 views

Constructing a tainted string for arc injection

I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++. In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in the ...
0
votes
0answers
164 views

Stack buffer overflow: Is compiler changing variables order, preventing me to overwrite EIP properly?

I am learning about stack buffer overflow. A little info about my target: A x86 little endian intel-based computer, with a target compiled with TCC Compiler with no protections of any kind running on ...
-1
votes
3answers
144 views

There could be still buffer overflows in ex.: C?

I recently read about the $subject. Q: Why does a programming language has built-in trivial insecurity? Or.. it was just in the old times? How could this be?
-1
votes
2answers
769 views

Generate openSSL certificates from within C code using commands?

This is an openSSL command for generating a private key and a certificate, openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key The question I have is whether there is some ...