Programming is the act of issuing commands that a computer system executes, via certain interfaces called programming languages.

learn more… | top users | synonyms

-1
votes
0answers
19 views

Compile C programme into standalone DLL using mingw [migrated]

Im wondering whether it's possible to generate a standalone DLL from a simple C programme. I have the following code to create a user and add to admin group on successful execution. I can compile ...
0
votes
1answer
53 views

How does (Py)NaCl work exactly?

At the moment, I deal with PyNaCl (Docs) and have a question about it: My situation is that I want to create a server that interacts with clients. Both the server and the client will have a long-term ...
3
votes
3answers
140 views

Methods for determining if a file is encypted?

I am working on a anti-ransomware project. It simply monitors the filesystem, and watches for files being created, and deleted. (also monitors for known ransomware file extensions.) Basic Operation: ...
1
vote
1answer
57 views

How can programming knowledge help towards information security [duplicate]

Im interested in becoming a cyber security expert. I feel comfortable with my networking skills but im worried about my programming skills. How important is for a cyber security expert to have ...
-4
votes
1answer
72 views

Sum two SHA256 to get a SHA512 [closed]

I see this code in a web game SHA512(SeedServer + "|" + SeedUser) and I'm trying to reproduce this hash. I tried in PHP: <?php echo hash('SHA512', '...
6
votes
1answer
246 views

How, if at all, are some programming languages inherently less safe?

Can it be that applications written on certain languages are inherently less safe, no matter how hard you try to get it straight? Or, can it be that some programming paradigms are less safe than ...
0
votes
1answer
102 views

Recent malware programming language? [closed]

I'm working on pentesting as part of Information Security course. Recently I have been in some Education Oriented Malware... But I have only developed in .NET oriented applications. How is malware ...
2
votes
2answers
102 views

when defining constants, is #define more secure than static const?

I want to have some constant values in my program, for example, I have a constant value TimeLimit in a header which is commonly used in other classes, but I don't know if #define TimeLimit 30 is ...
47
votes
5answers
4k views

Teaching “Secure by Design”

I'm a Security Architect, and I'm used to defining the security of project as a specification that gets carried out by others. I have been recently tasked with teaching new coders how to design and ...
48
votes
9answers
13k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
2
votes
1answer
128 views

How to exploit this piece of code? (format string in printf?) [closed]

So this piece of code is vulnerable to format string vuln (I think) in the printf() function. It reads a file in /tmp/file so I've tried writing different modifier/strings in that file and see what ...
7
votes
5answers
1k views

Is it possible to be a hacker without being a criminal?

I am interested in information security, and I want to be a "hacker." I want to write hacking tools, make viruses, and other stuff... For me, programming botnets are a lot of fun, but how can ...
10
votes
1answer
272 views

What benefits do Hardware Security Modules provide when keys are not stored inside them?

I'm researching a project that makes use of cryptography. It is a .net application with keys stored in a sql server database. For cryptography, the project uses a Hardware Security Module similar to ...
2
votes
0answers
109 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
0
votes
3answers
504 views

How can I avoid buffer overflows when programming an Android app? [closed]

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...
0
votes
1answer
314 views

RSA: same symbols in plaintext give same symbols ciphertext?

I just started studying Information Security, but I just ran this program: http://www.sanfoundry.com/cpp-program-implement-rsa-algorithm/ and faced this strange thing. For small keys (don't try to ...
2
votes
3answers
3k views

Simple string comparisons not secure against timing attacks [duplicate]

As I learned in a comment for How to encrypt in PHP, properly?, I was told using a string comparison like the following in PHP is susceptible to timing attacks. So it should not be used to compare two ...
3
votes
5answers
573 views

Secure software development checklist [closed]

I'm looking for a secure software development checklist. I know that there exists several secure development methodologies (for example Which Secure Development Lifecycle model to choose?), which ...
1
vote
2answers
142 views

Does preventing buffer overflow attacks prevent ROP attacks?

Would preventing buffer overflow attacks prevent Return Oriented Programming (ROP) attacks?
2
votes
2answers
285 views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
4
votes
1answer
134 views

Would DLL hijacking work with load-time linking?

I was wondering if DLL hijacking would work with all types of linking or just run-time linking. I hear that malware uses it and wanted to know how it works
69
votes
10answers
10k views

Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?

Is it good secure programming practice to overwrite sensitive data stored in a variable before it is deleted (or goes out of scope)? My thought is that it would prevent a hacker from being able to ...
0
votes
1answer
323 views

Are shell scripts / bash inherently less secure than other (script) languages such as python?

Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts? Or are shell scripts / bash less advisable for some tasks such as parsing ...
0
votes
2answers
973 views

Can't understand SNORT rule pcre option syntax “?P=name”

While trying to understand some SNORT rule lines, I came across the following syntax that I could not figure. Could not find any description in the manual (though admittedly I've not read it all ...
0
votes
2answers
390 views

Programming languages for security? [duplicate]

I am a computer science student interested in the field of security and just had a few questions. What are the pros and cons for using C# for security purposes, I had assumed applications programmed ...
0
votes
2answers
1k views

How much programming knowledge do I need to enter the security field? [closed]

I'm still young (16 years old) and I haven't entered the security field yet. I'm curious how much programming I need to enter the security field. I can write real-life programs in Python. I can also ...
3
votes
2answers
181 views

Crypto software: overwrite sensitive buffer

Is it common to implement crypto software in such a way that sensitive buffers are overwritten before free'ing memory? For example when they contain a private key or the plaintext message.
48
votes
11answers
9k views

Are there “secure” languages? [closed]

Are there any programming languages that are designed to be robust against hacking? In other words, an application can be hacked due to a broken implementation, even though the design is perfect. I'...
17
votes
5answers
6k views

Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?

IIUC the Heartbleed vulnerability happens due to a bug in the C source code of OpenSSL, by performing a memcpy() from a buffer that is too short. I'm wondering if the bug would have been prevented ...
3
votes
1answer
290 views

security clearance for programmers

I am programmer by day and night, I work within security at the moment working on some security products. I have noticed a few non software engineering based roles which require security clearance. I ...
0
votes
1answer
120 views

Confused about career path [closed]

My question probably will be blocked. Anyway, my question is how much programming is there in the security field. Useless: I really hate programming, actually I can translate code from C to python ...
18
votes
5answers
2k views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
2
votes
1answer
950 views

Implementation language for crypto

I'm going to implement a small crypto lib/tool. The "do not implement crypto by yourself" rule does not apply here, since this crypto system is new and not implemented yet. ;) So the first step is the ...
-9
votes
1answer
261 views

Viable way to ruin a milk corporation? [closed]

Hack into their system and change the "Sell by" date so that it is immediately bad. How long do you think until they notice, if you pull it off?
4
votes
2answers
1k views

Builder vs. Breaker - Do developers make good pen testers & vice versa

Do developers necessarily make good penetration testers & vice versa? The reason I ask is that I find I have much more of a knack for figuring out how an existing piece of software works and can ...
2
votes
2answers
807 views

Required skills before jumping into vulnerability research

Hello I'm a beginner into IT security. I want to become ethical hacker. So I know how to use metasploit to write exploits, and how to use different fuzzers, but I think this isn't enough. I can read ...
2
votes
1answer
8k views

How to learn programming from a hacker's prospective [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming ...
1
vote
2answers
1k views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
-1
votes
2answers
577 views

Is CISSP suitable for a Java architect? [closed]

I am a tech lead developing web (Java/JEE) and mobile applications (Android) for the past 12 years (mobile in last year though). I am somehow interested in IT security. Is it worth taking CISSP or ...
1
vote
2answers
511 views

Which PCR we can extend by using our own code?

As there are 24 PCR's in TPM 1.2 specification. Some of these PCRs are reserved and cannot be extended by user's code. Below are the PCR Index with their usage: 0 - CRTM, BIOS and Platform Extensions ...
11
votes
7answers
2k views

Why are security-crucial software written in unsafe languages?

This may be a stupid question, but... Why are security-crucial software written in languages such as C and C++? I understand why, say, an embedded system might need a low-level language to make the ...
-2
votes
2answers
251 views

need guidance for cybersecurity job [closed]

I'm 17 yrs old and I'm Thai. I have been in a military school and I really love computer stuff especially security stuff. My question here is what should my career be and what could I study now as a ...
6
votes
3answers
687 views

What is a buffer overflow?

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly. It has also mentioned how certain bad programming practises involving memory can be "...
19
votes
6answers
4k views

Becoming a malware analyst?

So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
1
vote
1answer
295 views

Can particular object be detected and extracted from RAM? [closed]

I was Googling for a while now, and I don't seem to find what I am looking for. Imagine I have a programm running (for example some random image generator, perhaps captcha) and I have a background ...
5
votes
3answers
959 views

how can an attacker use a fake temp file to compromise a program?

I am taking a security class. The class notes say that an attacker can observe a pattern in temp file names and then make their own temp file to compromise a program. They say that if a temp file is ...
5
votes
1answer
769 views

Using OpenSSL as a library versus calling output from standalone command in a program being written

In another question about how to use OpenSSL programmatically a community member was writing, one suggestion was to use the system() command whereas another was to include the C headers and work with ...
2
votes
1answer
177 views

Secure Development Environment for University dealing with private data

We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out ...
7
votes
3answers
1k views

Why must all classes' data members be set to private?

In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured". How does setting members to private makes the program ...
1
vote
2answers
121 views

How do I sanitize and check large numbers that will be sent to an unmanaged BigNum library like GMP?

I need to process data that is sent by users in a LargeNumber format. My current choices are BigInteger (.Net Managed Code) IntX (Managed Code, faster for some operations) GMP / MPIR (Unmanaged ...