Programming is the act of issuing commands that a computer system executes, via certain interfaces called programming languages.
11
votes
4answers
335 views
Becoming a malware analyst?
So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
1
vote
1answer
115 views
Can particular object be detected and extracted from RAM? [closed]
I was Googling for a while now, and I don't seem to find what I am looking for.
Imagine I have a programm running (for example some random image generator, perhaps captcha) and I have a background ...
5
votes
3answers
97 views
how can an attacker use a fake temp file to compromise a program?
I am taking a security class. The class notes say that an attacker can observe a pattern in temp file names and then make their own temp file to compromise a program. They say that if a temp file is ...
4
votes
1answer
55 views
Using OpenSSL as a library versus calling output from standalone command in a program being written
In another question about how to use OpenSSL programmatically a community member was writing, one suggestion was to use the system() command whereas another was to include the C headers and work with ...
2
votes
1answer
79 views
Secure Development Environment for University dealing with private data
We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out ...
5
votes
3answers
218 views
Why must all classes' data members be set to private?
In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured".
How does setting members to private makes the program ...
1
vote
2answers
69 views
How do I sanitize and check large numbers that will be sent to an unmanaged BigNum library like GMP?
I need to process data that is sent by users in a LargeNumber format. My current choices are
BigInteger (.Net Managed Code)
IntX (Managed Code, faster for some operations)
GMP / MPIR (Unmanaged ...
5
votes
2answers
90 views
how does a return to system allow an attacker to evade a non-executable stack?
I am learning about return to system call attacks for a security class. I understand that in this kind of attack, attackers replace the standard return value for a stack frame with the address of a ...
0
votes
2answers
205 views
Best beginning programming language for someone interested in IT security [closed]
Backstory:
At the moment I'm someone with very limited knowledge on computers and programming, but I would like to change that. I have discovered that I'm mainly interested in IT security and that I ...
19
votes
7answers
611 views
At what level of abstraction should a developer work with with regards to cryptography?
I have recently came across an old blog post by Jeff Atwood which got me thinking.
What could be easier than a EncryptStringForBrowser() method which has security and tamper-resistance built in, ...
29
votes
6answers
2k views
Teaching a loved one about secure coding practices
This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
1
vote
2answers
102 views
Auditing EXEs to ensure buffer overflow protections are in place? (such as SEHOP, ASLR, and DEP)
According to this answer, it's possible to compile a GCC-based application without certain buffer overflow techniques. Perhaps this is even possible with Visual Studio.
How can I audit a given EXE ...
5
votes
1answer
471 views
“Hello World” example of a Buffer Overflow attack in many programming languages
I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used
Ideally (and if ...
1
vote
0answers
308 views
Why do complex viruses tend to be written in assembly? [closed]
For example Simile is extremely complex and is written in assembly. If something is going to be complicated isn't it best NOT to write it in assembly?
1
vote
1answer
155 views
Advice on selecting programming languages to concentrate on? (2nd year IT security student) [closed]
I'm in the process of considering which programming languages I should devote the majority of my coding studies to. I'm a 2nd year CS student, majoring in IT security.
What I want to do/work with:
...
19
votes
6answers
4k views
What defines a programming language as useful for hacking?
I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing.
My question is: What is it that makes those languages ...
2
votes
4answers
1k views
Reverse engineering (decompiling) an .exe file in OSX
I am a complete newby in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain.
Does anybody know a good decompiler of .exe for OSX, or any hint about where ...
