Programming is the act of issuing commands that a computer system executes, via certain interfaces called programming languages.

learn more… | top users | synonyms

-1
votes
0answers
12 views

How can you figure out which encryption was used just by looking at the data? [duplicate]

I have 1500 lines, which were encrypted (by a random encryption method) and then encoded using base64. Let's say I can easily write code to decode the base64 strings. After that I get the encrypted ...
-4
votes
1answer
64 views

Sum two SHA256 to get a SHA512 [closed]

I see this code in a web game SHA512(SeedServer + "|" + SeedUser) and I'm trying to reproduce this hash. I tried in PHP: <?php echo hash('SHA512', ...
6
votes
1answer
239 views

How, if at all, are some programming languages inherently less safe?

Can it be that applications written on certain languages are inherently less safe, no matter how hard you try to get it straight? Or, can it be that some programming paradigms are less safe than ...
0
votes
1answer
95 views

Recent malware programming language? [closed]

I'm working on pentesting as part of Information Security course. Recently I have been in some Education Oriented Malware... But I have only developed in .NET oriented applications. How is malware ...
68
votes
10answers
10k views

Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?

Is it good secure programming practice to overwrite sensitive data stored in a variable before it is deleted (or goes out of scope)? My thought is that it would prevent a hacker from being able to ...
2
votes
2answers
94 views

when defining constants, is #define more secure than static const?

I want to have some constant values in my program, for example, I have a constant value TimeLimit in a header which is commonly used in other classes, but I don't know if #define TimeLimit 30 is ...
47
votes
5answers
4k views

Teaching “Secure by Design”

I'm a Security Architect, and I'm used to defining the security of project as a specification that gets carried out by others. I have been recently tasked with teaching new coders how to design and ...
48
votes
9answers
12k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
2
votes
1answer
116 views

How to exploit this piece of code? (format string in printf?) [closed]

So this piece of code is vulnerable to format string vuln (I think) in the printf() function. It reads a file in /tmp/file so I've tried writing different modifier/strings in that file and see what ...
7
votes
5answers
1k views

Is it possible to be a hacker without being a criminal?

I am interested in information security, and I want to be a "hacker." I want to write hacking tools, make viruses, and other stuff... For me, programming botnets are a lot of fun, but how can ...
1
vote
0answers
105 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
8
votes
1answer
200 views

What benefits do Hardware Security Modules provide when keys are not stored inside them?

I'm researching a project that makes use of cryptography. It is a .net application with keys stored in a sql server database. For cryptography, the project uses a Hardware Security Module similar to ...
0
votes
1answer
309 views

RSA: same symbols in plaintext give same symbols ciphertext?

I just started studying Information Security, but I just ran this program: http://www.sanfoundry.com/cpp-program-implement-rsa-algorithm/ and faced this strange thing. For small keys (don't try to ...
4
votes
1answer
131 views

Would DLL hijacking work with load-time linking?

I was wondering if DLL hijacking would work with all types of linking or just run-time linking. I hear that malware uses it and wanted to know how it works
0
votes
3answers
430 views

How can I avoid buffer overflows when programming an Android app? [closed]

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...
47
votes
11answers
9k views

Are there “secure” languages? [closed]

Are there any programming languages that are designed to be robust against hacking? In other words, an application can be hacked due to a broken implementation, even though the design is perfect. ...
3
votes
5answers
512 views

Secure software development checklist [closed]

I'm looking for a secure software development checklist. I know that there exists several secure development methodologies (for example Which Secure Development Lifecycle model to choose?), which ...
1
vote
2answers
966 views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
2
votes
3answers
2k views

Simple string comparisons not secure against timing attacks [duplicate]

As I learned in a comment for How to encrypt in PHP, properly?, I was told using a string comparison like the following in PHP is susceptible to timing attacks. So it should not be used to compare two ...
1
vote
2answers
133 views

Does preventing buffer overflow attacks prevent ROP attacks?

Would preventing buffer overflow attacks prevent Return Oriented Programming (ROP) attacks?
2
votes
2answers
245 views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
3
votes
1answer
280 views

security clearance for programmers

I am programmer by day and night, I work within security at the moment working on some security products. I have noticed a few non software engineering based roles which require security clearance. I ...
18
votes
5answers
2k views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
19
votes
6answers
4k views

Becoming a malware analyst?

So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
0
votes
1answer
305 views

Are shell scripts / bash inherently less secure than other (script) languages such as python?

Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts? Or are shell scripts / bash less advisable for some tasks such as parsing ...
28
votes
8answers
33k views

What defines a programming language as useful for hacking?

I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing. My question is: What is it that makes those languages ...
0
votes
2answers
898 views

Can't understand SNORT rule pcre option syntax “?P=name”

While trying to understand some SNORT rule lines, I came across the following syntax that I could not figure. Could not find any description in the manual (though admittedly I've not read it all ...
17
votes
5answers
5k views

Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?

IIUC the Heartbleed vulnerability happens due to a bug in the C source code of OpenSSL, by performing a memcpy() from a buffer that is too short. I'm wondering if the bug would have been prevented ...
0
votes
2answers
369 views

Programming languages for security? [duplicate]

I am a computer science student interested in the field of security and just had a few questions. What are the pros and cons for using C# for security purposes, I had assumed applications programmed ...
0
votes
2answers
1k views

How much programming I need to enter the security field [closed]

I'm still young (16 years old) and I didn't enter the security field. So I'm curious how much programming do I need to enter the security field. I can write real-life programs in python(I mean ...
3
votes
2answers
178 views

Crypto software: overwrite sensitive buffer

Is it common to implement crypto software in such a way that sensitive buffers are overwritten before free'ing memory? For example when they contain a private key or the plaintext message.
1
vote
2answers
448 views

Which PCR we can extend by using our own code?

As there are 24 PCR's in TPM 1.2 specification. Some of these PCRs are reserved and cannot be extended by user's code. Below are the PCR Index with their usage: 0 - CRTM, BIOS and Platform Extensions ...
0
votes
1answer
118 views

Confused about career path [closed]

My question probably will be blocked. Anyway, my question is how much programming is there in the security field. Useless: I really hate programming, actually I can translate code from C to python ...
2
votes
1answer
886 views

Implementation language for crypto

I'm going to implement a small crypto lib/tool. The "do not implement crypto by yourself" rule does not apply here, since this crypto system is new and not implemented yet. ;) So the first step is the ...
-9
votes
1answer
245 views

Viable way to ruin a milk corporation? [closed]

Hack into their system and change the "Sell by" date so that it is immediately bad. How long do you think until they notice, if you pull it off?
4
votes
2answers
1k views

Builder vs. Breaker - Do developers make good pen testers & vice versa

Do developers necessarily make good penetration testers & vice versa? The reason I ask is that I find I have much more of a knack for figuring out how an existing piece of software works and can ...
2
votes
2answers
751 views

Required skills before jumping into vulnerability research

Hello I'm a beginner into IT security. I want to become ethical hacker. So I know how to use metasploit to write exploits, and how to use different fuzzers, but I think this isn't enough. I can read ...
2
votes
1answer
8k views

How to learn programming from a hacker's prospective [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming ...
-1
votes
2answers
548 views

Is CISSP suitable for a Java architect? [closed]

I am a tech lead developing web (Java/JEE) and mobile applications (Android) for the past 12 years (mobile in last year though). I am somehow interested in IT security. Is it worth taking CISSP or ...
11
votes
7answers
2k views

Why are security-crucial software written in unsafe languages?

This may be a stupid question, but... Why are security-crucial software written in languages such as C and C++? I understand why, say, an embedded system might need a low-level language to make the ...
6
votes
1answer
726 views

Haskell and Happstack security

I'm currently investigating Haskell as a platform for secure web development. I'm leaning toward happstack for the web framework part, but I'm also investigating yesod and snap. My gut feeling says ...
34
votes
6answers
3k views

Teaching a loved one about secure coding practices

This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
4
votes
5answers
8k views

Reverse engineering (decompiling) an .exe file in OSX

I am a complete newby in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain. Does anybody know a good decompiler of .exe for OSX, or any hint about where ...
-2
votes
2answers
247 views

need guidance for cybersecurity job [closed]

I'm 17 yrs old and I'm Thai. I have been in a military school and I really love computer stuff especially security stuff. My question here is what should my career be and what could I study now as a ...
6
votes
3answers
662 views

What is a buffer overflow?

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly. It has also mentioned how certain bad programming practises involving memory can be ...
1
vote
1answer
289 views

Can particular object be detected and extracted from RAM? [closed]

I was Googling for a while now, and I don't seem to find what I am looking for. Imagine I have a programm running (for example some random image generator, perhaps captcha) and I have a background ...
5
votes
3answers
895 views

how can an attacker use a fake temp file to compromise a program?

I am taking a security class. The class notes say that an attacker can observe a pattern in temp file names and then make their own temp file to compromise a program. They say that if a temp file is ...
5
votes
1answer
744 views

Using OpenSSL as a library versus calling output from standalone command in a program being written

In another question about how to use OpenSSL programmatically a community member was writing, one suggestion was to use the system() command whereas another was to include the C headers and work with ...
2
votes
1answer
175 views

Secure Development Environment for University dealing with private data

We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out ...
7
votes
3answers
1k views

Why must all classes' data members be set to private?

In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured". How does setting members to private makes the program ...