Programming is the act of issuing commands that a computer system executes, via certain interfaces called programming languages.

learn more… | top users | synonyms

69
votes
10answers
10k views

Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?

Is it good secure programming practice to overwrite sensitive data stored in a variable before it is deleted (or goes out of scope)? My thought is that it would prevent a hacker from being able to ...
48
votes
9answers
13k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
48
votes
11answers
9k views

Are there “secure” languages? [closed]

Are there any programming languages that are designed to be robust against hacking? In other words, an application can be hacked due to a broken implementation, even though the design is perfect. ...
47
votes
5answers
4k views

Teaching “Secure by Design”

I'm a Security Architect, and I'm used to defining the security of project as a specification that gets carried out by others. I have been recently tasked with teaching new coders how to design and ...
34
votes
6answers
3k views

Teaching a loved one about secure coding practices

This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
29
votes
8answers
33k views

What defines a programming language as useful for hacking?

I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing. My question is: What is it that makes those languages ...
25
votes
7answers
1k views

At what level of abstraction should a developer work with with regards to cryptography?

I have recently came across an old blog post by Jeff Atwood which got me thinking. What could be easier than a EncryptStringForBrowser() method which has security and tamper-resistance built in, ...
19
votes
6answers
4k views

Becoming a malware analyst?

So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
18
votes
5answers
2k views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
17
votes
5answers
6k views

Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?

IIUC the Heartbleed vulnerability happens due to a bug in the C source code of OpenSSL, by performing a memcpy() from a buffer that is too short. I'm wondering if the bug would have been prevented ...
11
votes
7answers
2k views

Why are security-crucial software written in unsafe languages?

This may be a stupid question, but... Why are security-crucial software written in languages such as C and C++? I understand why, say, an embedded system might need a low-level language to make the ...
8
votes
1answer
219 views

What benefits do Hardware Security Modules provide when keys are not stored inside them?

I'm researching a project that makes use of cryptography. It is a .net application with keys stored in a sql server database. For cryptography, the project uses a Hardware Security Module similar to ...
7
votes
5answers
1k views

Is it possible to be a hacker without being a criminal?

I am interested in information security, and I want to be a "hacker." I want to write hacking tools, make viruses, and other stuff... For me, programming botnets are a lot of fun, but how can ...
7
votes
3answers
1k views

Why must all classes' data members be set to private?

In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured". How does setting members to private makes the program ...
6
votes
1answer
243 views

How, if at all, are some programming languages inherently less safe?

Can it be that applications written on certain languages are inherently less safe, no matter how hard you try to get it straight? Or, can it be that some programming paradigms are less safe than ...
6
votes
3answers
671 views

What is a buffer overflow?

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly. It has also mentioned how certain bad programming practises involving memory can be ...
6
votes
1answer
727 views

Haskell and Happstack security

I'm currently investigating Haskell as a platform for secure web development. I'm leaning toward happstack for the web framework part, but I'm also investigating yesod and snap. My gut feeling says ...
5
votes
3answers
925 views

how can an attacker use a fake temp file to compromise a program?

I am taking a security class. The class notes say that an attacker can observe a pattern in temp file names and then make their own temp file to compromise a program. They say that if a temp file is ...
5
votes
1answer
3k views

“Hello World” example of a Buffer Overflow attack in many programming languages

I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used Ideally (and if ...
5
votes
1answer
755 views

Using OpenSSL as a library versus calling output from standalone command in a program being written

In another question about how to use OpenSSL programmatically a community member was writing, one suggestion was to use the system() command whereas another was to include the C headers and work with ...
4
votes
5answers
8k views

Reverse engineering (decompiling) an .exe file in OSX

I am a complete newby in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain. Does anybody know a good decompiler of .exe for OSX, or any hint about where ...
4
votes
2answers
1k views

Builder vs. Breaker - Do developers make good pen testers & vice versa

Do developers necessarily make good penetration testers & vice versa? The reason I ask is that I find I have much more of a knack for figuring out how an existing piece of software works and can ...
4
votes
1answer
131 views

Would DLL hijacking work with load-time linking?

I was wondering if DLL hijacking would work with all types of linking or just run-time linking. I hear that malware uses it and wanted to know how it works
3
votes
2answers
179 views

Crypto software: overwrite sensitive buffer

Is it common to implement crypto software in such a way that sensitive buffers are overwritten before free'ing memory? For example when they contain a private key or the plaintext message.
3
votes
1answer
304 views

how does a return to system allow an attacker to evade a non-executable stack?

I am learning about return to system call attacks for a security class. I understand that in this kind of attack, attackers replace the standard return value for a stack frame with the address of a ...
3
votes
5answers
548 views

Secure software development checklist [closed]

I'm looking for a secure software development checklist. I know that there exists several secure development methodologies (for example Which Secure Development Lifecycle model to choose?), which ...
3
votes
1answer
283 views

security clearance for programmers

I am programmer by day and night, I work within security at the moment working on some security products. I have noticed a few non software engineering based roles which require security clearance. I ...
3
votes
3answers
132 views

Methods for determining if a file is encypted?

I am working on a anti-ransomware project. It simply monitors the filesystem, and watches for files being created, and deleted. (also monitors for known ransomware file extensions.) Basic Operation: ...
2
votes
3answers
2k views

Simple string comparisons not secure against timing attacks [duplicate]

As I learned in a comment for How to encrypt in PHP, properly?, I was told using a string comparison like the following in PHP is susceptible to timing attacks. So it should not be used to compare two ...
2
votes
1answer
912 views

Implementation language for crypto

I'm going to implement a small crypto lib/tool. The "do not implement crypto by yourself" rule does not apply here, since this crypto system is new and not implemented yet. ;) So the first step is the ...
2
votes
2answers
774 views

Required skills before jumping into vulnerability research

Hello I'm a beginner into IT security. I want to become ethical hacker. So I know how to use metasploit to write exploits, and how to use different fuzzers, but I think this isn't enough. I can read ...
2
votes
2answers
256 views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
2
votes
1answer
8k views

How to learn programming from a hacker's prospective [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming ...
2
votes
2answers
95 views

when defining constants, is #define more secure than static const?

I want to have some constant values in my program, for example, I have a constant value TimeLimit in a header which is commonly used in other classes, but I don't know if #define TimeLimit 30 is ...
2
votes
1answer
176 views

Secure Development Environment for University dealing with private data

We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out ...
2
votes
1answer
122 views

How to exploit this piece of code? (format string in printf?) [closed]

So this piece of code is vulnerable to format string vuln (I think) in the printf() function. It reads a file in /tmp/file so I've tried writing different modifier/strings in that file and see what ...
1
vote
2answers
136 views

Does preventing buffer overflow attacks prevent ROP attacks?

Would preventing buffer overflow attacks prevent Return Oriented Programming (ROP) attacks?
1
vote
1answer
2k views

Best beginning programming language for someone interested in IT security [closed]

Backstory: At the moment I'm someone with very limited knowledge on computers and programming, but I would like to change that. I have discovered that I'm mainly interested in IT security and that I ...
1
vote
2answers
171 views

Auditing EXEs to ensure buffer overflow protections are in place? (such as SEHOP, ASLR, and DEP)

According to this answer, it's possible to compile a GCC-based application without certain buffer overflow techniques. Perhaps this is even possible with Visual Studio. How can I audit a given EXE ...
1
vote
1answer
53 views

How can programming knowledge help towards information security [duplicate]

Im interested in becoming a cyber security expert. I feel comfortable with my networking skills but im worried about my programming skills. How important is for a cyber security expert to have ...
1
vote
2answers
120 views

How do I sanitize and check large numbers that will be sent to an unmanaged BigNum library like GMP?

I need to process data that is sent by users in a LargeNumber format. My current choices are BigInteger (.Net Managed Code) IntX (Managed Code, faster for some operations) GMP / MPIR (Unmanaged ...
1
vote
2answers
994 views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
1
vote
1answer
292 views

Can particular object be detected and extracted from RAM? [closed]

I was Googling for a while now, and I don't seem to find what I am looking for. Imagine I have a programm running (for example some random image generator, perhaps captcha) and I have a background ...
1
vote
0answers
106 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
1
vote
0answers
2k views

Why do complex viruses tend to be written in assembly? [closed]

For example Simile is extremely complex and is written in assembly. If something is going to be complicated isn't it best NOT to write it in assembly?
1
vote
2answers
476 views

Which PCR we can extend by using our own code?

As there are 24 PCR's in TPM 1.2 specification. Some of these PCRs are reserved and cannot be extended by user's code. Below are the PCR Index with their usage: 0 - CRTM, BIOS and Platform Extensions ...
0
votes
1answer
311 views

RSA: same symbols in plaintext give same symbols ciphertext?

I just started studying Information Security, but I just ran this program: http://www.sanfoundry.com/cpp-program-implement-rsa-algorithm/ and faced this strange thing. For small keys (don't try to ...
0
votes
3answers
456 views

How can I avoid buffer overflows when programming an Android app? [closed]

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...
0
votes
1answer
314 views

Are shell scripts / bash inherently less secure than other (script) languages such as python?

Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts? Or are shell scripts / bash less advisable for some tasks such as parsing ...
0
votes
2answers
1k views

How much programming knowledge do I need to enter the security field? [closed]

I'm still young (16 years old) and I haven't entered the security field yet. I'm curious how much programming I need to enter the security field. I can write real-life programs in Python. I can also ...