Security relative to source-code edition, protection and management.

learn more… | top users | synonyms

8
votes
1answer
165 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in ...
0
votes
0answers
10 views

Manipulating Output From Fortify Audit Workbench [migrated]

I have an output from a Fortify SCA Scan and I am viewing it in the Audit Workbench. I am looking for a way to list out the file paths and line numbers of vulnerabilities found. For e.g., if the ...
2
votes
0answers
57 views

How often are codebases compromised? [on hold]

I'm currently trying to research which get compromised more often; databases or codebases? My guess would be that databases are the obvious answer and most of the time easier to compromise, because of ...
11
votes
9answers
38k views

Programming language for network security

I am working as a tester now. I am planning to move to the domain of security such as a CEH or CISSP. But many say that to be a great hacker you need to know at least one programming language well. I ...
1
vote
1answer
52 views

How to check third party code for Security? [closed]

This may be a very broad question. I am a software developer and from time to time we use third party components which may / may not be secure. Are there any basic things that I should check the ...
27
votes
2answers
3k views

Identifying the author(s) of a piece of malware

When a new piece of malware appears, people can try to determine where it comes from, and who its authors could be. How do security experts attempt to identify the authors of a new publicly disclosed ...
43
votes
6answers
5k views

How do large companies protect their source code?

I recently read the canonical answer of our ursine overlord to the question on How do certification authorities store their private root keys? I then just had to ask myself: How do large companies ...
2
votes
4answers
3k views

Writing file shredder

I want to write a simple file shredder in c++, i.e. a program that deletes a file so that it is not recoverable. Would the following be a secure and correct way to do that? (1) Open the file with ...
5
votes
1answer
47 views

Safely Experimenting With Sockets

I'm learning about TCP/IP and (Berkeley/UNIX) socket programming. Let's say I have two scenarios: 1) I write two programs in C, a client and a server, and bind them each to a non-well-known port on ...
1
vote
2answers
107 views

Way to find security bugs in Scala source code open-source way?

I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others ...
-1
votes
2answers
74 views

How do researchers identify vulnerability in closed source software? [closed]

Came across an article, it is about the new BadWinmail vulnerability in Outlook. Being a closed-source software, how do researchers manage to point out that Outlook is not sandboxing the flash? Is ...
7
votes
2answers
61 views

Searching vulnerabilities via similar code comparison. Is it a viable attack vector?

Consider the following scenario: the attacker scans (optimally automatically) open codebases (eg. GitHub) for vulnerable code fragments by checking bug reports and patches. the attacker scans for ...
4
votes
2answers
486 views

Can a virus infect source code files with dangerous data?

If a user was infected with a file altering virus is it possible that checked in code (files containing text) to the source control could contain dangerous properties. I ask this after this got me ...
4
votes
1answer
2k views

Hiding backdoors in Open Source code in other languages than C and C++?

I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
0
votes
1answer
90 views

How can I prove to users of the software that the binaries I post match source code that's been inspected and verified by a third party? [duplicate]

If I have software that's like TrueCrypt where security is very important, but unlike TrueCrypt because mine won't mysteriously go offline for seemingly no reason at all, how can I prove that my ...
18
votes
1answer
1k views

Is there a way to verify a binary against the sources?

It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the ...
6
votes
4answers
769 views

Source code auditing and fake builds

I am wondering about source code auditing and how hard it would be to fake a build to be audited? Let me explain. Say I would be a dishonest programmer that would wish to put in some backdoor into ...
2
votes
1answer
54 views

When can I commit an OpenSSL Certificate (.pem) to source control?

That is to say, in what cases does it make sense to commit .cer files, or a stack of .cer files in a .pem, to internal source control like SVN or Git? If it's just a list of signed public keys, I ...
17
votes
2answers
2k views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
62
votes
7answers
9k views

Does one need to be a good programmer to perform secure source code analysis?

A person has good knowledge of overall security risks, knows what OWASP Top 10 vulnerabilities are, and has certifications like CEH, CISSP, OSCP, etc. which are more black-box testing. And also he has ...
20
votes
5answers
5k views

When can I commit a Private Key to source control?

That is to say, in what cases does it make sense to commit an unencrypted keypair to internal source control like SVN or Git? Related question that discusses an encrypted private key: Is it bad ...
0
votes
0answers
50 views

Unable to do transformation of findbugs xml reports due to integration issue with findsecbugs plugin

I am trying to integrate the find-security-bugs plugin for findbugs using maven. I am able to run findbugs with maven and perform transformation from xml to html without any issue. I am able to run ...
1
vote
2answers
177 views

Open Source OS - code you see vs code you get

In this question I will use the example of Linux OS, but I am also interested in general situation. Linux OS distributions are famous for being open source and thus rather secure. But how can you be ...
0
votes
1answer
35 views

Security of Data and Source Code in a 3rd Party Hosting Environment [closed]

What expectation should I have for the security of my data and codebase hosted with a 3rd party e.g. godaddy, or any other similar hosting provider. How common is it that some IT employee within the ...
1
vote
0answers
76 views

Findbugs Source Code Analyzer not able to detect vulnerabilities in JSP file?

I am using FindBugs to do source code analysis along with Find Security Bugs plugin to specifically detect security vulnerabilities like SQL Injection, XSS, etc. I installed the FindBugs plugin for ...
8
votes
5answers
13k views

Hiding JavaScript source code

In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
0
votes
1answer
40 views

Having trouble with FindBugs exclude filter

I installed FindBugs plugin in Eclipse for Source Code Analysis with FindSecurityBugs plugin to find out security issues with the code. I want to filter out certain false positives and want to exclude ...
19
votes
4answers
3k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
2
votes
0answers
172 views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
4
votes
1answer
106 views

Never heard of compiler vulnerabilities when compiling?

Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code. ...
3
votes
1answer
279 views

How could a publicly available stream cipher (RC4) be kept secret so long?

I'm reading about the cryptographic function called RC4. Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use. How did it stay ...
5
votes
2answers
248 views

Keeping passwords out of source code

Secrets should not be in source code and in version control because of two reasons: External threat: An attacker can exploit a vulnerability to get access to files/source of your ...
6
votes
5answers
4k views

What reputable site should I download Putty from?

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code. If you needed to download Putty for a high security Windows ...
3
votes
1answer
35 views

Solution for Enterprise SW Eng. with Github and NPM [closed]

Can anyone share an architecture or framework that supports the use of Open Source software in enterprise software development environments? I'm seeking solutions to manage and mitigate the risk of ...
9
votes
4answers
9k views

How can I enumerate all the saved RSA keys in the Microsoft CSP?

I have an application that is creating several keys and storing them in various stores (in this case the Machine store). How can I enumerate all the keys on a given Windows system? ...
19
votes
4answers
5k views

Malwares source repositories. Where? [closed]

As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
4
votes
1answer
324 views

Anyone use the International Domain Name (IDN) security mitigation API's? Is there a wrapper for .NET?

The International Domain Name mitigation API's are available here for download. Has anyone used them since they were first published in 2006? Are there any pending updates to them (I can't find a ...
2
votes
5answers
348 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
13
votes
3answers
3k views

ASP.NET MVC security check list

I am planning to start a new web site on ASP.NET MVC 2 (3). Does anybody a full (if possible) check list of actions, approaches I should reach to avoid almost problems with security?
18
votes
2answers
3k views

Rails - protection against code injection and XSS

I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS? I know Rails tries to prevent ...
4
votes
2answers
227 views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
11
votes
7answers
5k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
3
votes
2answers
212 views

What are the security risks in leaving 'sudo' inside my production code?

I have a script that can only run successfully with root permissions But in development it's really hard to run with root permissions (in my development environment) so I add 'sudo' when ever it's ...
-1
votes
2answers
59 views

Can Tor pre-built binaries be different than if someone builds from source? [closed]

Is there a possibility (and how likely is it) that the pre-built binaries of Tor that most of us use are backdoored or altered in some way, unlike the source code?
0
votes
1answer
112 views

Source code of Firefox Add-ons

How can I be sure that a browser add-on that is released under the GPL is actually really using the source code that was published? I read somewhere that the source code of Chrome add-ons is viewable ...
8
votes
2answers
821 views

Security issues with PHP Sandbox

I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
24
votes
6answers
5k views

Source code as password

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'? As an ...
1
vote
0answers
88 views

Vetting new IT development staff [closed]

In the realm of software development what would be the best way to vet prospective employees? We handle potentially sensitive information, and a code base which could be potentially lucrative to ...
2
votes
5answers
849 views

Software Testing vs (Web) Penetration Testing

I would like to ask about the differences between Software Testing and Web Application Penetration Testing. I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) ...
2
votes
1answer
118 views

How to set up a multi-developer environment with emphasis on source code security?

One of my clients runs a small software development company (15 employees) with PHP as their sole server side development language. They are having a networked environment with all the computers ...