Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [programming]

Programming is the act of issuing commands that a computer system executes, via certain interfaces called programming languages.

119
votes
19answers
32k views

Is it common to allow local desktop admin access and rights for developers in organizations?

I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people). Recently due to security concerns our IT and ...
81
votes
19answers
16k views

Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app

I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched. The catch is that the ...
77
votes
10answers
15k views

Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?

Is it good secure programming practice to overwrite sensitive data stored in a variable before it is deleted (or goes out of scope)? My thought is that it would prevent a hacker from being able to ...
56
votes
11answers
13k views

Are there “secure” languages? [closed]

Are there any programming languages that are designed to be robust against hacking? In other words, an application can be hacked due to a broken implementation, even though the design is perfect. I'...
53
votes
5answers
4k views

Teaching “Secure by Design”

I'm a Security Architect, and I'm used to defining the security of project as a specification that gets carried out by others. I have been recently tasked with teaching new coders how to design and ...
51
votes
9answers
18k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
37
votes
6answers
3k views

Teaching a loved one about secure coding practices

This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
32
votes
8answers
48k views

What defines a programming language as useful for hacking?

I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing. My question is: What is it that makes those languages suitable?...
27
votes
7answers
2k views

At what level of abstraction should a developer work with with regards to cryptography?

I have recently came across an old blog post by Jeff Atwood which got me thinking. What could be easier than a EncryptStringForBrowser() method which has security and tamper-resistance built in, ...
26
votes
3answers
4k views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
20
votes
6answers
6k views

Becoming a malware analyst?

So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
20
votes
5answers
3k views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
19
votes
5answers
7k views

Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?

IIUC the Heartbleed vulnerability happens due to a bug in the C source code of OpenSSL, by performing a memcpy() from a buffer that is too short. I'm wondering if the bug would have been prevented ...
18
votes
7answers
4k views

Why are security-crucial software written in unsafe languages?

This may be a stupid question, but... Why are security-crucial software written in languages such as C and C++? I understand why, say, an embedded system might need a low-level language to make the ...
14
votes
3answers
12k views

Simple string comparisons not secure against timing attacks [duplicate]

As I learned in a comment for How to encrypt in PHP, properly?, I was told using a string comparison like the following in PHP is susceptible to timing attacks. So it should not be used to compare two ...
14
votes
1answer
3k views

What benefits do Hardware Security Modules provide when keys are not stored inside them?

I'm researching a project that makes use of cryptography. It is a .net application with keys stored in a sql server database. For cryptography, the project uses a Hardware Security Module similar to ...
9
votes
1answer
302 views

Is it worth it to fuzz Rust-written software?

If a program is written in C, then it is worth it to fuzz it with something like afl since it might have memory-related bugs. But how about software written in Rust? Would a fuzzer still find bugs? Or ...
8
votes
3answers
283 views

Sealed Room Security - Possibility of writing assembled binary code

Assume the existence of a sealed room, containing a network with a single terminal. You are not allowed to bring in any electronic material into the room. The target machine is running default ...
8
votes
5answers
2k views

What is a buffer overflow?

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly. It has also mentioned how certain bad programming practises involving memory can be "...
8
votes
3answers
3k views

how can an attacker use a fake temp file to compromise a program?

I am taking a security class. The class notes say that an attacker can observe a pattern in temp file names and then make their own temp file to compromise a program. They say that if a temp file is ...
7
votes
5answers
1k views

Is it possible to be a hacker without being a criminal?

I am interested in information security, and I want to be a "hacker." I want to write hacking tools, make viruses, and other stuff... For me, programming botnets are a lot of fun, but how can ...
7
votes
3answers
2k views

Why must all classes' data members be set to private?

In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured". How does setting members to private makes the program ...
7
votes
3answers
12k views

Methods for determining if a file is encypted?

I am working on a anti-ransomware project. It simply monitors the filesystem, and watches for files being created, and deleted. (also monitors for known ransomware file extensions.) Basic Operation: ...
6
votes
6answers
15k views

Reverse engineering (decompiling) an hackme challenge .exe file in OSX

I am a complete newbie in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain. Does anybody know a good decompiler of .exe for OSX, or any hint about where ...
6
votes
1answer
278 views

How, if at all, are some programming languages inherently less safe?

Can it be that applications written on certain languages are inherently less safe, no matter how hard you try to get it straight? Or, can it be that some programming paradigms are less safe than ...
6
votes
1answer
885 views

Haskell and Happstack security

I'm currently investigating Haskell as a platform for secure web development. I'm leaning toward happstack for the web framework part, but I'm also investigating yesod and snap. My gut feeling says ...
5
votes
2answers
4k views

Builder vs. Breaker - Do developers make good pen testers & vice versa

Do developers necessarily make good penetration testers & vice versa? The reason I ask is that I find I have much more of a knack for figuring out how an existing piece of software works and can ...
5
votes
2answers
1k views

Do the skills of a software developer transfer well into working in computer security or white hat hacking? [closed]

I am conflicted. I want to become a software developer but I am also interested in the networking side of things… Is software development and network security 2 whole different beasts? If they are, ...
5
votes
1answer
4k views

“Hello World” example of a Buffer Overflow attack in many programming languages

I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used Ideally (and if possible)...
5
votes
1answer
1k views

Using OpenSSL as a library versus calling output from standalone command in a program being written

In another question about how to use OpenSSL programmatically a community member was writing, one suggestion was to use the system() command whereas another was to include the C headers and work with ...
5
votes
1answer
297 views

Would DLL hijacking work with load-time linking?

I was wondering if DLL hijacking would work with all types of linking or just run-time linking. I hear that malware uses it and wanted to know how it works
4
votes
5answers
2k views

Secure software development checklist [closed]

I'm looking for a secure software development checklist. I know that there exists several secure development methodologies (for example Which Secure Development Lifecycle model to choose?), which ...
4
votes
2answers
282 views

Crypto software: overwrite sensitive buffer

Is it common to implement crypto software in such a way that sensitive buffers are overwritten before free'ing memory? For example when they contain a private key or the plaintext message.
4
votes
1answer
1k views

how does a return to system allow an attacker to evade a non-executable stack?

I am learning about return to system call attacks for a security class. I understand that in this kind of attack, attackers replace the standard return value for a stack frame with the address of a ...
4
votes
2answers
190 views

Why malwares need to be light

I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible. In an example C++ source code, authors decided to remain ...
3
votes
2answers
235 views

Would the Cloudbleed have been prevented if Rust was used?

Would the Cloudbleed have been prevented if Rust was used? I know it is not the same as Heartbleed, but Rust would probably have prevented Heartbleed.
3
votes
1answer
406 views

Does it matter in which programming language you write the shellcode?

I have been searching a lot and I didn't find anything. I still wonder: does it matter in which language you write shellcode? Will shellcode in Assembly, C, etc. work everywhere they can be used and ...
3
votes
2answers
1k views

Required skills before jumping into vulnerability research

Hello I'm a beginner into IT security. I want to become ethical hacker. So I know how to use metasploit to write exploits, and how to use different fuzzers, but I think this isn't enough. I can read ...
3
votes
3answers
4k views

Is this integer overflow vulnerability exploitable?

Is this integer overflow exploitable and if the answer is yes, how can i exploit it? char buffer[20]; int len = atoi(argv[1]); if(len < 20) memcpy(buffer,argv[2],len); If I set len to -1 the ...
3
votes
2answers
283 views

when defining constants, is #define more secure than static const?

I want to have some constant values in my program, for example, I have a constant value TimeLimit in a header which is commonly used in other classes, but I don't know if #define TimeLimit 30 is ...
3
votes
1answer
841 views

security clearance for programmers

I am programmer by day and night, I work within security at the moment working on some security products. I have noticed a few non software engineering based roles which require security clearance. I ...
3
votes
1answer
16k views

How to learn programming from a hacker's prospective [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming ...
3
votes
1answer
170 views

Are there any IoT Systematic Creation Security Checklists?

Are you aware of any publicly available documents that would help IoT/Connected product creators develop a systematic/programmatic approach and/or process to securing such new age devices?
3
votes
1answer
193 views

What is properly way to manage and remove symmetric key in C#

If I have a symmetric key in a byte[] array in C#, how can I erase it securely? for (int i = 0; i < array.Length; i++) { array[i] = 0; } Is this good enough?
3
votes
0answers
124 views

How is it possible that the Metasploit meterpreter can take pictures without “notifying” the user?

Im curious how the Meterpreter can take pictures from my webcam without turning on the webcam LED? Ive read that you have to write/change a driver, or a firmware, or you just change some DLLs, but ...
2
votes
1answer
2k views

Implementation language for crypto

I'm going to implement a small crypto lib/tool. The "do not implement crypto by yourself" rule does not apply here, since this crypto system is new and not implemented yet. ;) So the first step is the ...
2
votes
2answers
2k views

Do high-level programming languages have more vulnerabilities or security risks than low-level languages? [closed]

Do high-level programming languages have more vulnerabilities or security risks than low-level programming languages and if so, why? Image source: http://a.files.bbci.co.uk/bam/live/content/znmb87h/...
2
votes
1answer
6k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
2
votes
1answer
212 views

Secure Development Environment for University dealing with private data

We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out ...
2
votes
1answer
390 views

Dynamic forking of a process in win32 vs modern antiviruses

Most tutorials about crypters assume that popular antiviruses don't scan programs executed directly from memory. However from what I've seen, some of them (e.g. Nod32) are able to scan RAM in search ...