auditing source code for security aspects

learn more… | top users | synonyms

10
votes
4answers
776 views

Criteria for Evaluating Static Analysis Tools

As with any tools purchase part of the outcome is in how good the evaluation criteria are, so I'd be interested to hear any criteria people might use when assessing Security static analysis tools. ...
7
votes
5answers
965 views

Code Review Strategies

As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...
2
votes
2answers
138 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
7
votes
3answers
638 views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
8
votes
5answers
2k views

How to review code for backdoors?

I have a codebase that needs a code review to evaluate it for backdoors. The code is far too big to review it all, how would you recommend approaching the problem. It is a java web application with ...
6
votes
3answers
408 views

How to rate Open Source Libraries?

Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
4
votes
2answers
353 views

Security review: is this PHP mcrypt wrapper class safe?

Update (6 February 2015): It seems like the class in question has actually updated as a response to the answers here (through an issue, now closed, raised on github). I was looking for ...
13
votes
5answers
3k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
3
votes
1answer
372 views

Is my AES/CTR/RIPEMD encryption correctly implemented?

Below is my encryption implementation in PHP. It's based on mcrypt, and uses AES-128 in CTR mode along with a RIPEMD-128 HMAC for integrity checking. For brevity, I've inlined the functions for ...
17
votes
3answers
3k views

White-box vs. Black-box

What are the relative advantages and disadvantages of each form of testing? I.e. What is the difference between static code analysis and runtime/dynamic penetration testing? What are the pros and cons ...
-2
votes
2answers
102 views

Why do static code analyzers cite CWE rather than CVE in their findings?

I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
1
vote
0answers
83 views

What tools on unix can scan sql dumps for malware? [closed]

I'm attempting to check for malware, spam and any kind of injection/exploitation on a sql dump that has been provided and was wondering what kind of tools are there already in place to help with this? ...
4
votes
3answers
611 views

Static code review approach

My questions is related with static code analysis approach used by Veracode vs Fortify/AppScan. Veracode – Finds security flaws in application binaries and bytecode without requiring source ...
1
vote
2answers
507 views

Tampering req.getParameter() Vs req.getAttribute() [closed]

Is following code vulnerable? If yes, how it can be exploited? <% Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite"); String someSiteUrl = ...
1
vote
1answer
60 views

Resources for reviewing multi-tiered webabbs in Spring, Hibernate or JAX-WS

I need some pointers to any resources (videos from any conferences or general videos, pdf, anything) for secure source code reviewing of multi-tiered web-apps in JAX-WS, Spring or Hibernate. I am ...
4
votes
1answer
283 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, ...
3
votes
2answers
629 views

Box web application security review - legality? [closed]

is it legal to do a security review/pentest of a web application that we bought and operate on our servers? Meaning, the whole infrastructure is ours + we bought a licence for the software. Can we do ...
1
vote
2answers
211 views

Static code analysis strategies [closed]

Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case? For example: We know ...
3
votes
1answer
220 views

OpenSSL Code Review

Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is ...
2
votes
3answers
213 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
0
votes
0answers
12 views

Fixing Memory Safety Error for Fread [duplicate]

Can someone pls explain how I can fix the following valgrind error on fread? I tried doing if (fread(valueCon, 1, intCount, f) == intCount){ then execute}; but that does not seem to change anything. ...
3
votes
4answers
251 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
0
votes
1answer
314 views

what freeware tool for java source code review? [closed]

I need freeware tool for source code review for my application which used WebSphere Portal and Java as technology. Please provide me relevant information or links regarding this.
8
votes
4answers
2k views

Is there a real risk of exploitation in java code where a null pointer is dereferenced

I'm playing with some generally well written and parsed java code, but there are some oddities thrown up by my code scanning tool. I know a null pointer dereference can crash a program, but assuming ...
0
votes
2answers
103 views

How to properly select a code audit company? [closed]

How should I go about selecting a code auditing company?
6
votes
2answers
516 views

SELinux and text relocations exploitability

I have been assigned the task of adopting and implementing a certain backup software solution for our GNU/Linux farm. As per my deparment defined requirements, this solution should support SELinux ...
3
votes
1answer
1k views

Hiding backdoors in Open Source code in other languages than C and C++?

I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
9
votes
1answer
276 views

Do the Windows shared source files compile into the same binaries as the retail version?

Microsoft makes the Windows source code available to certain third party organisations such as the US and foreign governments, universities etc. This is their Shared Source Initiative Is this a ...
31
votes
6answers
3k views

Teaching a loved one about secure coding practices

This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
7
votes
1answer
164 views

How to encourage responsible disclosure (and react appropriately otherwise)

As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...
5
votes
2answers
742 views

What are good free opensource tools for helping in manual source code reviews? [closed]

I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
7
votes
4answers
2k views

What Checkstyle or Findbugs rules detect common vulnerabilities?

Looking for experience with both built in and custom checks. I do not need references to commercial source code analysers.
3
votes
2answers
6k views

Are there any free static analysis tools for C# / .NET code

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
3
votes
2answers
138 views

How to assess severity/impact of vulnerability

In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
5
votes
3answers
1k views

Secure source code review tool for jQuery

Does anyone know any secure source code review tool for jQuery/jQueryUI. I've looked around a bit but couldn't find anything. Its too good if it is opensource.
8
votes
2answers
497 views

How dangerous is it to use third-party security audit tools?

This question is inspired by two related questions (How safe is backtrack to use, and How to Install, Configure and Use LSAT on Unix SE). Besides a dated (and patched) vulnerability in LSAT ...
31
votes
5answers
4k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
5
votes
6answers
824 views

Could a computer program be used to automate testing for trapdoors?

Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
9
votes
4answers
5k views

Any useful tools for Android source code review? [closed]

I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS. Fortify seems ...
5
votes
3answers
204 views

How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)

I posted today a pretty cool PoC where I was able to provide real-time 'security vulnerability feedback' to a developer as he is writing code in VisualStudio. You can see the video at Real-time ...
3
votes
1answer
465 views

Base64 encode diffences in BCrypt implemenations

I was reading the source code of several BCrypt implementations and found that two common c implementations have a difference in their base64 encoding of for the salt. What is the effect, if any, of ...
10
votes
3answers
3k views

Can anyone suggest good open source tools for scanning source code for vulnerabilities? [closed]

I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
39
votes
3answers
3k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
7
votes
1answer
1k views

Is Request.getHeader(“host”) vulnerable?

If the following is the code snippet, what would be your suggestions? <script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script> Is this a clear ...
5
votes
2answers
1k views

HTML 5 Security Code Scanner

Are there code scanners in the market that scan HTML 5 code? Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
7
votes
6answers
2k views

Fortify360 - Sinks & Sources - Vulnerability count

In an application security environment, I use Fortify Software's Fortify360 on a daily basis. One of my biggest hurdles is explaining the numbers (sources vs sinks) Fortify flags each location in ...
5
votes
3answers
376 views

What to consider in an SLA to ensure secure software when outsourcing software development?

To ensure secure development in the off shore team what are considerations to be taken into account in the SLA? I got this as a reference: ...
6
votes
8answers
690 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...
2
votes
1answer
541 views

Intepreting PE (Portable Executable) headers of suspicious malware files

I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated. Using PEview I am examining the .text, .rdata and .data headers. I know that if there is a big ...
5
votes
1answer
1k views

Code Review on a Header Injection In Java : any help?

I'm auditing a piece of Java code that might be vulnerable to header injection : String headerValue =request.getParameter("headerVal"); //escaping CRLF headerValue = headerValue.replace("\n", ""); ...