Security relative to source-code edition, protection and management.

learn more… | top users | synonyms

2
votes
2answers
538 views

How to protect source code that resides on virtualbox web server which starts at boot?

I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can ...
5
votes
2answers
1k views

What are good free opensource tools for helping in manual source code reviews? [closed]

I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
8
votes
4answers
3k views

What Checkstyle or Findbugs rules detect common vulnerabilities?

Looking for experience with both built in and custom checks. I do not need references to commercial source code analysers.
3
votes
2answers
10k views

Are there any free static analysis tools for C# / .NET code

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
5
votes
1answer
996 views

ROP Exploitation on ARM

I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture. Are there any tools, such as mona.py ...
9
votes
7answers
381 views

Proving running code on a website is unchanged

Can it be proved to the user that the running code behind a website with security related code is the same as published? I'm currently looking at a few new project ideas and one involves secure ...
-1
votes
1answer
320 views

How to prevent code injection like automatically adding extra character? [closed]

Code: $result = "Hello World"; $jsonEncodeValue = $result; echo $jsonEncodedValue; Assumed Output: "Hello World" Real Output: \n"Hello World" This \n Line Feed added automatically. For this ...
86
votes
7answers
5k views

How do I know a piece of software only does what the author claims?

Without being a programmer or a computer expert, how can I know if a particular program or any piece of software in general doesn't have hidden unwanted functions compromising privacy and security?
11
votes
5answers
576 views

Does naming sensitive things discreetly provide protection?

I had a job where a manager said he liked naming servers after places because if they were named descriptively e.g. "passwords database server" they become obvious targets. I sort of generalized this ...
4
votes
2answers
1k views

Tools for analyzing Perl 5 code? [closed]

I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but I'...
-1
votes
1answer
1k views

Changing user account passwords from PHP script - vulnerabilities? [closed]

I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
5
votes
6answers
1k views

Could a computer program be used to automate testing for trapdoors?

Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
4
votes
2answers
1k views

Code Injection detection on Web Servers

Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
7
votes
1answer
1k views

Is Request.getHeader(“host”) vulnerable?

If the following is the code snippet, what would be your suggestions? <script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script> Is this a clear ...
2
votes
2answers
470 views

Is it a weakness to be able to see server side scripting?

Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction. CLARIFICATION: ...
5
votes
3answers
459 views

What to consider in an SLA to ensure secure software when outsourcing software development?

To ensure secure development in the off shore team what are considerations to be taken into account in the SLA? I got this as a reference: http://www.it-director.com/enterprise/technology/content.php?...
7
votes
8answers
449 views

Topics for SecureCoding course in C

So I was asked to put together a syllabus for a series of courses on the basics of secure coding, for a programming team. Though the time constraints are a bit... constraining, I'm working around that....
37
votes
8answers
4k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
1
vote
1answer
375 views

Which software scans software for potential vulnerabilities?

Is there any kind of parser-software-analysis tool that will analyze c code and outputs possible vulnerabilities like buffer oveflows?
6
votes
3answers
544 views

Are there any tools to detect JavaScript-based WCF/AJAX calls?

I'd like to determine if a given JavaScript contains the logic to make a AJAX/WCF call, or determine if one is being executed at runtime. Does anything like this exist?
5
votes
1answer
707 views

question for pentesters: PHP proc_open() in safe_mode

Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode? As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
8
votes
3answers
6k views

What programming language is Stuxnet written in?

I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in? Is the source code for Stuxnet available anywhere?
3
votes
2answers
841 views

vulnerable getlogin

I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin). I fail to understand the attack vector ...
2
votes
3answers
544 views

Securing dropdown boxes

I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured. ...
5
votes
0answers
14k views

Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]

This question was originally asked on stackoverflow I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff? I have a little JavaEE ...
5
votes
4answers
9k views

Reflector - obfuscated code

I run Reflector to de-compile some program and it seems to be obfuscated. I got following output, it’s not very useful. Any ideas how to decompile obfuscated code? [CompilerGenerated] get ...
7
votes
2answers
266 views

Should I store my intellectual property / code online?

As a hosting company we have gathered a busload of information over the years that are pretty much confidential. This information includes code, graphics, ERD diagrams, SEO strategies and so much more....
8
votes
5answers
1k views

Scripting a search through php files for dangerous calls for manual review

I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed. Does anyone have any recommendations for ...
5
votes
3answers
659 views

How do I protect myself against the attacks in this php script?

Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain directories),...
0
votes
2answers
591 views

TimThumb security alternative or fix?

"An image resizing utility called timthumb.php is widely used by many WordPress themes....The utility only does a partial match on hostnames allowing hackers to upload and execute arbitrary PHP code ...
0
votes
1answer
742 views

can the value of request.getHeader(“Host”) be faked?

Suppose if there is some code like <a href="<%=request.getHeader("Host")%>/xxx/abc.do>SignIn</a> Can an attacker fake request.getHeader("host") to point 'SignIn' anchor to ...
5
votes
1answer
685 views

Data loss protection in software artifacts

Data loss protection is a major concern to every industry. The software engineering process involves multiple points for potential data loss, as a number of parties are involved other than the client ...
1
vote
2answers
2k views

Is it possible to encrypt your Java source code and still have it readable & writable in Eclipse?

I have some Java source code on my laptop that would cause me a great deal of suffering if I were to lose possession of the laptop and the source code were to fall into someone else's hands. Is there ...
4
votes
1answer
848 views

Do blackbox penetration tests make sense if a whitebox audit would be possible as well?

Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
5
votes
2answers
374 views

What to do in response to a source code and/or database leak by a third party hosting provider?

My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak. On first appearances, the web host ...
11
votes
2answers
352 views

security implications of NULL dereference

Suppose we have code like this: struct somedata { int a; int b; }; struct somedata *data; /* ... */ data = malloc(sizeof(struct somedata)); data->a = something; Now, as you can see, NULL ...
16
votes
4answers
1k views

Does compiling from sources “kinda” protects from buffer overflow attacks?

While discussing buffers overflows, somebody told me that compiling your own binary for an application (with specific compilation flags) instead of using the "mainstream binary" makes it more ...
8
votes
4answers
3k views

How to protect ftp account information in the source code of a program

I wrote a game which stores high score information on an ftp server. In the the source code I need to write out the ftp link with the account name and password in it. For example: url = new URL("ftp:...
4
votes
1answer
1k views

Peer review of C# cryptography for Azure Table security

Edit: Update - I am researching how to implement AES with authentication in an efficient way for this project. If you have the time I'd appreciate your skill in finding the best implementation for ...
6
votes
5answers
683 views

Effect of Source Code Leakage of a security suite on security

I am interested to know what threats does it pose, if the source code of a security suite is leaked. It came to my mind after reading the following URLs: http://www.pentestit.com/2011/01/31/source-...
12
votes
4answers
755 views

What does defense in depth entail for a web app?

I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...
13
votes
5answers
3k views

Code Analysis: Binary vs Source

While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...
4
votes
1answer
204 views

Which is more secure: develop a mobile app in its Native language or using cross-platform UI?

I am just wondering if there are benefits from a security perspective to develop a mobile App either as native app or as a cross-platform UI app, in particular Rhodes? I need to develop an application ...
2
votes
1answer
881 views

Tutorial for SecurityCritical SecurityTransparent and new .NET 4 feature: Level 2

I need a primer for both the legacy (Level 1) .NET 2.0 security attributes and the new .NET 4 (Level 2) ones. I'm not familiar with the implications of controlling LinkDemand, stack walks, ...
4
votes
1answer
147 views

Does the compiler feature of Closures decrease member variable security?

Based on this discussion, closures in C# promote private variables to public variables at compile time. Suppose a closure was implemented on a Username or Password string. Would there be any ...
11
votes
4answers
9k views

What's the standard way to encrypt a file with a public key in Java?

I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the server?...
8
votes
3answers
2k views

PHP mail() Header Injection Prevention

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
10
votes
2answers
524 views

What is considered the simplest (or lightest) secure development lifecycle?

Microsoft has there simplified SDL: "The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development." "The process outlined in this paper ...