Security relative to source-code edition, protection and management.

learn more… | top users | synonyms

1
vote
3answers
141 views

How to prevent source code theft in web application development

I'm developing a webapplication working with PHP, SQL DB and other technologies. I'm always considering someone stealing the source code or using it to other means. How can you prevent someone from ...
5
votes
2answers
46 views

Patterns for searching a source repository for private data

I recently discovered a case where a colleague had accidentally committed their login credentials (host, username, and password) to a local source code repository, and then pushed these changes to a ...
0
votes
1answer
104 views

Detection of abnormal file access patterns

A company allows its developers access to snapshots of their entire codebase through a local network share. In order to perform their job, the developers compile code daily, where each compile reads a ...
1
vote
1answer
64 views

Security of a desktop application's source code [closed]

How easy is it to get the source code from a desktop application? Are there any protections in place to stop someone from viewing an application's code?
1
vote
0answers
14 views

Snort Modules Tweaking

I want to tweak and add new functionalities to snort code(Preprocessor)(v2.9.8). So,i have installed snort using source code,on ubuntu 14.04,however due to unknown problems,functionalities aren't ...
1
vote
0answers
37 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
4
votes
5answers
171 views

How to verify if a source code is safe before compiling it?

Sometimes Linux users need to to download a source code to be compiled then executed (the root privileges is granted). Is it possible for a source code to hide malicious code as a part of it? And how ...
1
vote
2answers
165 views

How can i read the source code of this encoded powershell script from the registry?

I get this line by ProcessExplorer C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([...
0
votes
2answers
84 views

Is any systematic method that can detect weak cryptographic algorithm in source code

Weak cryptographic algorithm should be removed from source code to avoid a false sense of security(for example: MD5. Of course, there is possibly the algorithm in source code, but it doesn't use the ...
-2
votes
1answer
134 views

How can startup companies protect their code from any intentional leakage? [duplicate]

So, how can new companies that have just started protect their source code from leaking by their employees? If it is a new company that means that the source code of the product is not so big and ...
1
vote
1answer
92 views

Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?

I am auditing (reverse engineering) an x86 C++ application without source code. Static analysis revealed that the application is using the IsBadReadPtr and IsBadWritePtr Win32 functions in almost ALL ...
2
votes
0answers
63 views

How often are codebases compromised? [closed]

I'm currently trying to research which get compromised more often; databases or codebases? My guess would be that databases are the obvious answer and most of the time easier to compromise, because of ...
1
vote
1answer
74 views

How to check third party code for Security? [closed]

This may be a very broad question. I am a software developer and from time to time we use third party components which may / may not be secure. Are there any basic things that I should check the ...
27
votes
2answers
3k views

Identifying the author(s) of a piece of malware

When a new piece of malware appears, people can try to determine where it comes from, and who its authors could be. How do security experts attempt to identify the authors of a new publicly disclosed ...
46
votes
6answers
7k views

How do large companies protect their source code?

I recently read the canonical answer of our ursine overlord to the question on How do certification authorities store their private root keys? I then just had to ask myself: How do large companies (e....
5
votes
1answer
48 views

Safely Experimenting With Sockets

I'm learning about TCP/IP and (Berkeley/UNIX) socket programming. Let's say I have two scenarios: 1) I write two programs in C, a client and a server, and bind them each to a non-well-known port on ...
-1
votes
2answers
112 views

How do researchers identify vulnerability in closed source software? [closed]

Came across an article, it is about the new BadWinmail vulnerability in Outlook. Being a closed-source software, how do researchers manage to point out that Outlook is not sandboxing the flash? Is ...
3
votes
1answer
159 views

When can I commit an OpenSSL Certificate (.pem) to source control?

That is to say, in what cases does it make sense to commit .cer files, or a stack of .cer files in a .pem, to internal source control like SVN or Git? If it's just a list of signed public keys, I ...
65
votes
7answers
9k views

Does one need to be a good programmer to perform secure source code analysis?

A person has good knowledge of overall security risks, knows what OWASP Top 10 vulnerabilities are, and has certifications like CEH, CISSP, OSCP, etc. which are more black-box testing. And also he has ...
1
vote
2answers
246 views

Way to find security bugs in Scala source code open-source way?

I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others ...
20
votes
5answers
5k views

When can I commit a Private Key to source control?

That is to say, in what cases does it make sense to commit an unencrypted keypair to internal source control like SVN or Git? Related question that discusses an encrypted private key: Is it bad ...
0
votes
0answers
152 views

Unable to do transformation of findbugs xml reports due to integration issue with findsecbugs plugin

I am trying to integrate the find-security-bugs plugin for findbugs using maven. I am able to run findbugs with maven and perform transformation from xml to html without any issue. I am able to run ...
1
vote
0answers
135 views

Findbugs Source Code Analyzer not able to detect vulnerabilities in JSP file?

I am using FindBugs to do source code analysis along with Find Security Bugs plugin to specifically detect security vulnerabilities like SQL Injection, XSS, etc. I installed the FindBugs plugin for ...
0
votes
1answer
113 views

Having trouble with FindBugs exclude filter

I installed FindBugs plugin in Eclipse for Source Code Analysis with FindSecurityBugs plugin to find out security issues with the code. I want to filter out certain false positives and want to exclude ...
0
votes
1answer
55 views

Security of Data and Source Code in a 3rd Party Hosting Environment [closed]

What expectation should I have for the security of my data and codebase hosted with a 3rd party e.g. godaddy, or any other similar hosting provider. How common is it that some IT employee within the ...
2
votes
0answers
445 views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
4
votes
1answer
282 views

How could a publicly available stream cipher (RC4) be kept secret so long?

I'm reading about the cryptographic function called RC4. Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use. How did it stay ...
5
votes
2answers
327 views

Keeping passwords out of source code

Secrets should not be in source code and in version control because of two reasons: External threat: An attacker can exploit a vulnerability to get access to files/source of your website/application....
4
votes
1answer
174 views

Never heard of compiler vulnerabilities when compiling?

Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code. ...
3
votes
1answer
39 views

Solution for Enterprise SW Eng. with Github and NPM [closed]

Can anyone share an architecture or framework that supports the use of Open Source software in enterprise software development environments? I'm seeking solutions to manage and mitigate the risk of ...
7
votes
2answers
76 views

Searching vulnerabilities via similar code comparison. Is it a viable attack vector?

Consider the following scenario: the attacker scans (optimally automatically) open codebases (eg. GitHub) for vulnerable code fragments by checking bug reports and patches. the attacker scans for ...
8
votes
1answer
418 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in ...
5
votes
2answers
330 views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
1
vote
2answers
96 views

Can pre-compiled binaries be different than if someone builds from source himself?

Given that I have an "acceptable" source code of some program (Tor was mentioned in a previous version of this question), where "acceptable" means that I trust this source code and want to use it for ...
0
votes
1answer
166 views

Source code of Firefox Add-ons

How can I be sure that a browser add-on that is released under the GPL is actually really using the source code that was published? I read somewhere that the source code of Chrome add-ons is viewable ...
25
votes
6answers
5k views

Source code as password

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'? As an ...
1
vote
0answers
89 views

Vetting new IT development staff [closed]

In the realm of software development what would be the best way to vet prospective employees? We handle potentially sensitive information, and a code base which could be potentially lucrative to ...
2
votes
5answers
1k views

Software Testing vs (Web) Penetration Testing

I would like to ask about the differences between Software Testing and Web Application Penetration Testing. I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) ...
3
votes
1answer
142 views

How to set up a multi-developer environment with emphasis on source code security?

One of my clients runs a small software development company (15 employees) with PHP as their sole server side development language. They are having a networked environment with all the computers ...
0
votes
2answers
2k views

Source code disclosure vulnerability

I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
1
vote
1answer
176 views

What precautions I can take to secure software against user?

I want to build a client that connects to my server and uses server API. You can consider this as a banking application because data security is the most important thing. Since the users or hackers ...
2
votes
0answers
265 views

rootkits subverting the windows kernel source code [closed]

I just purchased the book "rootkits: subverting the windows kernel" by Greg Hoglund and James Butler for a research project at work. However, this book constantly refers to the source code that can be ...
3
votes
2answers
278 views

What are the security risks in leaving 'sudo' inside my production code?

I have a script that can only run successfully with root permissions But in development it's really hard to run with root permissions (in my development environment) so I add 'sudo' when ever it's ...
2
votes
2answers
307 views

Expose the source code repository externally or allow VPN access?

To allow third party consultants, offshore developers and contractors working on the code, we can expose our Git repository externally. Or we can grant VPN access to the external parties and limit ...
4
votes
3answers
318 views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
2
votes
2answers
116 views

Can we verify that an app store ships the same code I have been shown?

When thinking about which messaging solution to use on my new "smart"phone I reflexively tended towards open source products, figuring that I could trust these more to actually provide the security ...
54
votes
5answers
4k views

Should security-critical code be reused or rewritten?

Usually, in programming, reusing code is always a better idea than writing your own implementation of an algorithm. If an implementation has been around for a long time and is still used by lots of ...
1
vote
1answer
288 views

Code deployment in PCI CDE

The PCI DSS v3 standard states the following: Network Segmentation To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that ...
21
votes
2answers
2k views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
0
votes
2answers
861 views

What are main differences between Source Code Analysis vs Static Application Security Testing(SAST)?

Do these 2 terminologies refer to the same thing? https://www.owasp.org/index.php/Source_Code_Analysis_Tools http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#.NET Some of the ...