Questions tagged [source-code]

Security relative to source-code edition, protection and management.

Filter by
Sorted by
Tagged with
1
vote
0answers
45 views

Is there a way to verify what code has been run? Maybe TEE? [duplicate]

I would like to verify that users are running particular source code. Is there a way this could be achieved? I want to verify that the original "algorithm" has been followed correctly if you ...
0
votes
2answers
67 views

How to Prevent Copying of Device Source Code in Manufacturing

Suppose you are going to mass manufacture custom circuit boards and would like the manufacturer to upload the device firmware onto these boards before shipping them out. What are some security systems/...
1
vote
0answers
21 views

Is it possible to verify the source code of a web service? [duplicate]

Let's say HonestInc is super generous and provides the source code of its web application HonestApp on github. However, I'm extremely distrustful of them, and have doubts that their actual server is ...
2
votes
1answer
61 views

Does recompiling a binary from source code make it more secure/obscure?

Using standard hardening options like PIC, Stack Protection ... does a mere recompilation make a program more secure against attacks? You have the source code of a program, compile it two times with ...
1
vote
2answers
111 views

How can I find if my website code has been implemented somewhere else?

The idea is to find, through some search engine or tool, a HTML tag structure, or HTML fingerprint, which reveals similarly coded pages to a particular one. A traditional search engine like Google or ...
0
votes
1answer
63 views

Can a source code be shared and secured form unauthorized use at the same time?

We have developed a script that generates certain reports as output. Input data being confidential in nature, one of our clients wants the code to be hosted in their country and also for the business ...
0
votes
1answer
58 views

Impact of the System Information Leak

Our application stored **e.printstacktrace()** in a log file, which is accessible to a specific user group. We need such detailed information for debugging purposes. As per the security team, they are ...
1
vote
1answer
68 views

Should we build a generic security unit test suite

as part of our secure SDLC we are delivering security as security requirements directly into the backlog of an application team. The security requirements will directly correlate to the functional ...
1
vote
1answer
91 views

Safe sharing source code with 3rd party for security review?

I work at a small software company, and we are working with another company that wants to use our software. However, their InfoSec team want us to have a 3rd party source code review completed, with ...
0
votes
1answer
98 views

How should I protect an algorithm that I want to sell?

I created a trading algorithm which I want to sell. People would be able to buy the "bot" at my website and it would run from there on (if this is even safe to do). What is the best way to ...
2
votes
3answers
136 views

Cryptographically prove open sourced source code of server

I want to prove that the source code I am using is the same as the open-sourced version, which is publicly available. My idea was to publish a hash of the open-sourced version and compare it to the ...
0
votes
1answer
120 views

How to prevent Source code excessive usage and redistribution?

We sell our code to a company that they can run our code 100 times a month. We need to do a few things before giving the code to the company. Hide our logic (we can hide our logic by code obfuscation)...
0
votes
2answers
122 views

Solutions for backing-up my codebase

I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github ...
1
vote
0answers
114 views

How to prevent azure pipelines (yaml) from being used as an attack vector?

Let's say the following scenario exists: A git repository exists on Azure DevOps Repos. The repository uses yaml pipelines (azure-pipelines.yml). The repository has branch policies to ensure that ...
-1
votes
1answer
143 views

What is the difference between “secure code review” and “secure static code analysis”?

What are the subtle differences in both - as one could say that both are almost the same... Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code ...
2
votes
2answers
101 views

Does removing features from a library increase or reduce security risks?

Software libraries targetting resource constrained environments like embedded systems use conditional compilation to allow consumers to shave space and thus increase performance by removing unused ...
0
votes
1answer
42 views

Proving a software deployment's origin sourcecode [duplicate]

Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL? sourcecode from commit #10020 at ...
86
votes
6answers
20k views

How am I ever going to be able to “vet” 120,000+ lines of Composer PHP code not written by me? [duplicate]

I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
1
vote
2answers
801 views

Is there a standard way to check if a requirements.txt has potential security issues? [closed]

Every open code repository has security issues. Attackers can use three ways to sneak malware in: Abuse typos: Create a package with a similar name, but the package is malware Malware + useful code: ...
1
vote
1answer
3k views

Path Manipulation Vulnerability

Currently I am working in code review process. I have few doubts regrading Path Manipulation Vulnerability. Some portion of the Path is already hard coded and with extension public class ReadFile { ...
0
votes
1answer
458 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
3
votes
3answers
482 views

Ken Thompson's compiler hack

I have gone through Ken Thompson's compiler hack paper; can't we just go through the compiler's source code and check for any backdoor, what was the article's point? Can we be sure that there are no ...
2
votes
1answer
1k views

PHP assert code injection

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php. $entityId = $_GET["name"]; public function getMetaData($entityId) { assert('...
1
vote
0answers
38 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
40
votes
5answers
7k views

How should source code security be checked?

How to check whether the source code of an open-source project contains no malicious content? For example, in a set of source code files with altogether 30,000 lines, there might be 1-2 lines ...
3
votes
1answer
229 views

How is compiling a program from source more secure?

When downloading compiled binaries for programs it is very important to check GPG signatures, Authenticode, hashes, etc. However, I often see people who say that compiling the code from source is the ...
1
vote
2answers
199 views

How to explain to our developer manager the benefits of using a linter also as a security feature?

Someone mentioned that linters would have helped not only for keeping the code looking better and friendlier, but also safer. ESlint has a rule to indicate, for example, to use {} which would have ...
5
votes
3answers
561 views

cases where companies suffered losses due to leaks of source code?

The damage associated with data breaches apparently caused Equifax to lose $4 billion in value and Facebook to lose about $50 billion, and even if not every dollar of those losses was due to the ...
0
votes
1answer
110 views

How curl provided source code that the browser did not?

I was playing a CTF and got stuck. When seeing the source code through web browser reveals nothing but when we send the request through curl it reveals out HIDDEN directory. How is it even possible? ...
1
vote
1answer
230 views

ISO 27001 and copying code from stackoverflow

So ever since we got certified, every time some code from stackoverflow is shown the ISO 27001 argument comes up "we can't copy code". As a dev, I have to say not allowing code form stackoverflow is ...
125
votes
8answers
24k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
0
votes
1answer
424 views

Is hiding my Java desktop app inside a VM the best way to protect my Java source code?

I need to distribute a Java desktop app to the user. I am looking at different ways to protect my source code from reverse engineering. One method is to distribute a Virtual Machine (says Linux) ...
0
votes
2answers
160 views

Restricting source code exposure

Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them. Also, say you want to keep certain files inaccessible to people ...
0
votes
4answers
388 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
1
vote
0answers
80 views

Single-Page Application authentication and ISO 27001

I have a single-page javascript application that communicates with a .NET API running in IIS. Authentication is done after loading the application frontend, using an OAuth token from Office 365, ...
2
votes
2answers
1k views

Protecting Python source code on physical product?

How would you protect Python source code on a physical product (like a IoT device), which comes with Ubuntu installed on a mini-PC running Python code? Few methods we thought about: Compiling the ...
-2
votes
1answer
514 views

How to secure PHP code for uploading avatar images?

I can bypass an avatar upload image verification process and upload a PHP file or any other extension binding a valid jpeg image. This is the code: if ($image->valid()) { $mimeType = $...
1
vote
2answers
1k views

How to make a well-known malicious programs undetectable by anti-virus solutions? [closed]

I want to make well-known malicious programs, like Mimikatz and Incognito, undetectable by anti-virus solutions. I have already tried various approaches myself, like packing the binary with UPX or ...
1
vote
1answer
888 views

How to Check Open Source Code for Vulnerabilities? [closed]

I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code. I want to ...
-1
votes
1answer
168 views

Secure PHP coding without frameworks

I am very new to PHP and some people said that writing PHP code without a framework is insecure. I am not sure about that! Is it possible to write highly secure code without any frameworks? If so, ...
1
vote
1answer
872 views

How to perform taint analysis on Java source code? [closed]

I want to perform taint analysis on java programs. I want to do this by finding functions calls, variable being modified, variable being accessed. So my question is how do I do this? I think Java ...
0
votes
2answers
756 views

Source Code analysis tools available? [closed]

In the near future I have to check the source code of a web application on security vulnerabilities. The web application mainly consists of PHP files and contains more than 300 files. Do you know ...
1
vote
1answer
227 views

Is it safe to commit ascii-armored symmetric private key to VCS?

What is the risk of committing an ascii-armored symmetric private key to VCS where the password lives outside of source control? This is a private closed-source repo. Two helpful topics: When can I ...
1
vote
0answers
25 views

Can files be retrieved from a VM instance state that was initially encrypted on a disk?

If I were to make a VM disk that was encrypetd, boot it, enter the encrypted passphrase and save the resulting 'image state' (of the running VM). Would this image have the 'encrypted' files easily ...
3
votes
1answer
240 views

How protected are files within a running encrypted VM on a possibly non secure hypervisor / host?

I've got a set of source code files (compiled C#) that I want to prevent direct read access to. The program will be running on the VM. I was thinking of storing these in an encrypted hard disk VM, the ...
1
vote
1answer
104 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
0
votes
1answer
417 views

NodeJs app files integrity security check [closed]

What are the recommended methods or approaches to check NodeJs application (hosted on Linux server) files integrity check for security check? There are usually huge number of files in node_modules/, ...
1
vote
2answers
4k views

Buffer overflow due to strlen, strcpy, strcat

I'm new to secure code review. I know that strlen will calculates the length until it finds a null character. This is a part of a larger code. char* executeMount(char* password, char* path, int ...
1
vote
0answers
105 views

What web application vulnerabilites are most likey to be found in a source code review vs a grey box pentest?

What type of vulnerabilities would be found additional in a source code review vs a pentest? If my organization performs regular grey box pentests, do we really require to perform source code reviews?...
0
votes
2answers
373 views

Is it safe to open virus infected EXE with Telerik JustDecompile?

My antivirus software has detected an EXE downloaded from Internet as infected with virus Malwr.Heur.MSILPerseus. It has quarantined it. However, I wanted to decompile & study it's code. Will it ...

1
2 3 4 5