auditing source code for security aspects

learn more… | top users | synonyms

0
votes
0answers
7 views

What are the security implications of external call by moviecliploader.loadclip(externalUrl)

I want to use a piece of Actionscript in this fashion var loader = new moviecliploader(); loader.loadclip("http://" + imageLocation, imageHolder); The web application firewall will keep out any jar:...
0
votes
0answers
28 views

Security code review Apple Swift - tools and documentation

I need to perform a security code review on a huge Swift application. I have done many mobile penetration tests before and some code review but never on iOS Swift Apps. I am primarily looking for ...
9
votes
2answers
286 views

Is SWIFT (banking) Software Architecture Secure?

With all the news about hacking banks and stealing money from banks over SWIFT, while the vulnerabilities weren't directly related to SWIFT, some questions arise: Are software components of the ...
9
votes
1answer
255 views

Is NoScript bad? [closed]

I just came to know about NoScript, but after installing it opened the author's homepage with an advert for 'SpeedUpMyPC' that pointed to a UniBlue website, which I found fishy. Googling turned up ...
1
vote
0answers
37 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
0
votes
3answers
80 views

What are some metrics to be used to evaluate SaaS security?

Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others? In case it isn't obvious, the code is available to audit and measure.
0
votes
1answer
52 views

Review of a protocol

I am wondering if anyone could give a second opinion whether the following is secure or not. I have a system which consist of a mobile device, FTP server and a PC. The mobile device is to upload ...
2
votes
1answer
69 views

How to get around hard coding a PFX password

I've got an application that acts as a SSL server. I've got the pfx file and in code, I've had to hard code the password to use in the following way PKCS12_parse(p12, PFXPassword, &pkey, &...
8
votes
2answers
147 views

Is the action of accepting a pull request on Github vulnerable to race conditions?

On github, any person (let's call them Alice) can fork a project, make modifications to it, and then submit those changes to the project owner(Bob) as a pull request, and the idea is that Bob reviews ...
1
vote
1answer
89 views

Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?

I am auditing (reverse engineering) an x86 C++ application without source code. Static analysis revealed that the application is using the IsBadReadPtr and IsBadWritePtr Win32 functions in almost ALL ...
0
votes
1answer
129 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ("Cache-Control:no-cache"...
22
votes
4answers
5k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
0
votes
1answer
146 views

How to check an open source product for password handling quality?

I just created an account on Magento Commerce, which is an online shop solution. During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain ...
8
votes
2answers
5k views

Do these regex show that I was hacked?

What do these regex commands mean? I found them when I ran the history command: grep --include=\*.php -rnw . -e "update.creditcard" grep --include=\*.php -rnw . -e "e41e" grep --include=\*.php -rnw . ...
0
votes
2answers
35 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
2
votes
2answers
712 views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
0
votes
3answers
149 views

Exploiting a desktop application

I'm studying application security and now I have a question which I couldn't find a good answer. Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
22
votes
3answers
2k views

What ways are there to verify a self-written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter. I needed to secure ...
3
votes
5answers
345 views

Why companies do not simply use hackers' tools to find their own vulnerabilities prior to the release of their software? [closed]

It may be a silly question, but hackers do use publicly-available tools to find vulnerabilities. So why don't companies, before releasing their products (Windows, Adobe etc...), use the same tools to ...
4
votes
2answers
970 views

Security review: is this PHP mcrypt wrapper class safe?

Update (6 February 2015): It seems like the class in question has actually updated as a response to the answers here (through an issue, now closed, raised on github). I was looking for an ...
2
votes
2answers
301 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
-1
votes
2answers
273 views

Why do static code analyzers cite CWE rather than CVE in their findings?

I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
1
vote
0answers
213 views

What tools on unix can scan sql dumps for malware? [closed]

I'm attempting to check for malware, spam and any kind of injection/exploitation on a sql dump that has been provided and was wondering what kind of tools are there already in place to help with this? ...
1
vote
1answer
80 views

Resources for reviewing multi-tiered webabbs in Spring, Hibernate or JAX-WS

I need some pointers to any resources (videos from any conferences or general videos, pdf, anything) for secure source code reviewing of multi-tiered web-apps in JAX-WS, Spring or Hibernate. I am ...
6
votes
4answers
2k views

Static code review approach

My questions is related with static code analysis approach used by Veracode vs Fortify/AppScan. Veracode – Finds security flaws in application binaries and bytecode without requiring source Fortify/...
3
votes
2answers
644 views

Box web application security review - legality? [closed]

is it legal to do a security review/pentest of a web application that we bought and operate on our servers? Meaning, the whole infrastructure is ours + we bought a licence for the software. Can we do ...
1
vote
2answers
466 views

Static code analysis strategies [closed]

Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case? For example: We know ...
3
votes
1answer
364 views

OpenSSL Code Review

Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is ...
4
votes
1answer
486 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, paramArrayList....
3
votes
1answer
554 views

Is my AES/CTR/RIPEMD encryption correctly implemented?

Below is my encryption implementation in PHP. It's based on mcrypt, and uses AES-128 in CTR mode along with a RIPEMD-128 HMAC for integrity checking. For brevity, I've inlined the functions for ...
2
votes
5answers
400 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
3
votes
4answers
393 views

Risk management with software code analysis

I am a programmer by day and I am working on a project that is focused around risk management based on PCI-DSS controls within an organisation. I have been thinking lately that a lot of PCI-DSS ...
0
votes
1answer
829 views

what freeware tool for java source code review? [closed]

I need freeware tool for source code review for my application which used WebSphere Portal and Java as technology. Please provide me relevant information or links regarding this.
0
votes
2answers
186 views

How to properly select a code audit company? [closed]

How should I go about selecting a code auditing company?
4
votes
1answer
2k views

Hiding backdoors in Open Source code in other languages than C and C++?

I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
9
votes
1answer
309 views

Do the Windows shared source files compile into the same binaries as the retail version?

Microsoft makes the Windows source code available to certain third party organisations such as the US and foreign governments, universities etc. This is their Shared Source Initiative Is this a ...
7
votes
1answer
222 views

How to encourage responsible disclosure (and react appropriately otherwise)

As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...
5
votes
2answers
1k views

What are good free opensource tools for helping in manual source code reviews? [closed]

I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
6
votes
2answers
748 views

SELinux and text relocations exploitability

I have been assigned the task of adopting and implementing a certain backup software solution for our GNU/Linux farm. As per my deparment defined requirements, this solution should support SELinux ...
3
votes
2answers
205 views

How to assess severity/impact of vulnerability

In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as ...
8
votes
4answers
3k views

What Checkstyle or Findbugs rules detect common vulnerabilities?

Looking for experience with both built in and custom checks. I do not need references to commercial source code analysers.
8
votes
2answers
660 views

How dangerous is it to use third-party security audit tools?

This question is inspired by two related questions (How safe is backtrack to use, and How to Install, Configure and Use LSAT on Unix SE). Besides a dated (and patched) vulnerability in LSAT (CVE-2007-...
34
votes
6answers
3k views

Teaching a loved one about secure coding practices

This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
3
votes
2answers
10k views

Are there any free static analysis tools for C# / .NET code

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
3
votes
1answer
794 views

Base64 encode diffences in BCrypt implemenations

I was reading the source code of several BCrypt implementations and found that two common c implementations have a difference in their base64 encoding of for the salt. What is the effect, if any, of ...
5
votes
6answers
1k views

Could a computer program be used to automate testing for trapdoors?

Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
1
vote
2answers
1k views

Tampering req.getParameter() Vs req.getAttribute() [closed]

Is following code vulnerable? If yes, how it can be exploited? <% Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite"); String someSiteUrl = (String)request....
5
votes
3answers
2k views

Secure source code review tool for jQuery

Does anyone know any secure source code review tool for jQuery/jQueryUI. I've looked around a bit but couldn't find anything. Its too good if it is opensource.
41
votes
3answers
4k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
5
votes
3answers
268 views

How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)

I posted today a pretty cool PoC where I was able to provide real-time 'security vulnerability feedback' to a developer as he is writing code in VisualStudio. You can see the video at Real-time ...