Questions tagged [source-code]
Security relative to source-code edition, protection and management.
235
questions
2
votes
4
answers
354
views
Code obfuscation and source code repositories
As I understand, code obfuscation is used to make reverse engineering difficult/hard for the adversaries/red team.
Now if I use a source code obfuscator where a .C/.CPP file is used as input and an ...
CommunityBot
- 1
6
votes
1
answer
637
views
MS08-067.c fails at WNetAddConnection2()
I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB.
The section:
WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
CommunityBot
- 1
-1
votes
2
answers
338
views
How can I find if my website code has been implemented somewhere else?
The idea is to find, through some search engine or tool, a HTML tag structure, or HTML fingerprint, which reveals similarly coded pages to a particular one.
A traditional search engine like Google or ...
CommunityBot
- 1
1
vote
1
answer
117
views
Validating web app source code integrity
I am interested if it could be possible to validate source code integrity for web apps somehow.
For example:
Developer builds app and sign source code with his private key. Both signature and public ...
CommunityBot
- 1
50
votes
3
answers
13k
views
Malicious code somehow hidden with whitespace?
I recently came across a php file on a compromised website that had what appeared (in Sublime Text) to be a huge white-space gap. When I run a diff against the original source file I can clearly see ...
- 1,019
1
vote
2
answers
251
views
Solutions for backing-up my codebase
I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github ...
CommunityBot
- 1
1
vote
3
answers
2k
views
C++ standard library use in malware
I was recently analyzing the sources of ZeuS, ZeroAccess, Carberp and other professional malware and there was one thing which I found weird:
The authors did not use the standard library std::-...
1
vote
1
answer
43
views
Is switching my C/C++ compiler for security testing generally reliable?
If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
- 11
1
vote
3
answers
105
views
Is it safe to check-in a RSA private key?
As far as I know, it is bad to check-in something like a password in a version control system. However, I saw in a project that a private_key.pem file with -----BEGIN RSA PRIVATE KEY----- ... content ...
- 7,717
2
votes
3
answers
168
views
Is Chrome's view-source dangerous when visiting malicious sites? [duplicate]
What are the risks of viewing the source code of malicious pages on Google Chrome?
I want to go directly to view-source:https://example-site.com to visit the sites without rendering anything malicious ...
- 65.1k
1
vote
1
answer
73
views
How to deal with targeted attacks from publisher when verifying the integrity of native applications and validating their source code?
I am trying to reason about how native apps can avoid the problems web apps have in dealing with the "Browser Cryptography Chicken and Egg" problem, which has been discussed numerous times ...
- 11.4k
2
votes
1
answer
1k
views
Tutorial for SecurityCritical SecurityTransparent and new .NET 4 feature: Level 2
I need a primer for both the legacy (Level 1) .NET 2.0 security attributes and the new .NET 4 (Level 2) ones.
I'm not familiar with the implications of controlling LinkDemand, stack walks, ...
- 2,265
76
votes
19
answers
6k
views
What security resources should a white-hat *developer* follow these days? [closed]
What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days?
Do Include:
Late breaking information on new security issues (RSS, Twitter, etc)
A website that tracks ...
- 2,265
5
votes
5
answers
3k
views
How to verify if a source code is safe before compiling it?
Sometimes Linux users need to to download a source code to be compiled then executed (the root privileges is granted).
Is it possible for a source code to hide malicious code as a part of it? And how ...
CommunityBot
- 1
1
vote
1
answer
99
views
How is it possible to simply a decode Bluetooth communications from a medical device?
Excuse the naive question but I'm trying to understand a bit about security in home health and medial devices and a recent report about how home Covid test results can be altered has left me a bit ...
- 1,952
86
votes
6
answers
81k
views
How do large companies protect their source code?
I recently read the canonical answer of our ursine overlord to the question on How do certification authorities store their private root keys?
I then just had to ask myself:
How do large companies (e....
- 1
3
votes
1
answer
337
views
How to prevent azure pipelines (yaml) from being used as an attack vector?
Let's say the following scenario exists:
A git repository exists on Azure DevOps Repos.
The repository uses yaml pipelines (azure-pipelines.yml).
The repository has branch policies to ensure that ...
- 127k
15
votes
8
answers
17k
views
Secure memcpy for pure C
Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code...
Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
- 2,084
3
votes
1
answer
399
views
Does using view page source on a possibly malicious site carry any real risks?
As far as I know, View page source does not execute any JavaScript, but is that good enough?
Could there in theory be any vulnerabilities in the HTML parser or something similar?
Have there been any ...
- 65.1k
2
votes
1
answer
161
views
Should we build a generic security unit test suite
As part of our secure SDLC, we are delivering security as security requirements directly into the backlog of an application team. The security requirements will directly correlate to the functional ...
- 127k
21
votes
6
answers
24k
views
How can I enumerate all the saved RSA keys in the Microsoft CSP?
I have an application that is creating several keys and storing them in various stores (in this case the Machine store).
How can I enumerate all the keys on a given Windows system?
...
0
votes
1
answer
150
views
Bypass encryption by altering source code
In the Cryptsetup Frequently Asked Questions page it says:
You are asked a passphrase of an existing key-slot first, before you can enter the passphrase for the new key-slot. Otherwise you could ...
- 193k
0
votes
1
answer
101
views
Building software in group [closed]
If one made software, but later needed others to work on the project, how to secure the software files and source code if one of the developers tried to share the source code with others or if someone ...
- 127k
0
votes
2
answers
219
views
secure the code of a server physically rented to the client
My company rents a Debian server to the clients, that they have to connect to their own network.
The server provides various services, an administration interface, and connects to the online service ...
1
vote
0
answers
47
views
Is there a way to verify what code has been run? Maybe TEE? [duplicate]
I would like to verify that users are running particular source code. Is there a way this could be achieved?
I want to verify that the original "algorithm" has been followed correctly if you ...
- 127k
0
votes
2
answers
141
views
How to Prevent Copying of Device Source Code in Manufacturing
Suppose you are going to mass manufacture custom circuit boards and would like the manufacturer to upload the device firmware onto these boards before shipping them out. What are some security systems/...
- 4,867
1
vote
0
answers
23
views
Is it possible to verify the source code of a web service? [duplicate]
Let's say HonestInc is super generous and provides the source code of its web application HonestApp on github. However, I'm extremely distrustful of them, and have doubts that their actual server is ...
- 3,492
8
votes
1
answer
664
views
Are there any type safe languages with deterministic compilers?
This article about BIND9 concludes with the statement:
The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in this ...
- 2,265
2
votes
1
answer
214
views
Does recompiling a binary from source code make it more secure/obscure?
Using standard hardening options like PIC, Stack Protection ...
does a mere recompilation make a program more secure against attacks?
You have the source code of a program, compile it two times with ...
- 8,903
0
votes
1
answer
155
views
Impact of the System Information Leak
Our application stored **e.printstacktrace()** in a log file, which is accessible to a specific user group. We need such detailed information for debugging purposes.
As per the security team, they are ...
- 493
0
votes
1
answer
120
views
Can a source code be shared and secured form unauthorized use at the same time?
We have developed a script that generates certain reports as output. Input data being confidential in nature, one of our clients wants the code to be hosted in their country and also for the business ...
CommunityBot
- 1
1
vote
1
answer
542
views
Safe sharing source code with 3rd party for security review?
I work at a small software company, and we are working with another company that wants to use our software. However, their InfoSec team want us to have a 3rd party source code review completed, with ...
- 58.3k
0
votes
1
answer
183
views
How should I protect an algorithm that I want to sell?
I created a trading algorithm which I want to sell. People would be able to buy the "bot" at my website and it would run from there on (if this is even safe to do).
What is the best way to ...
- 127k
1
vote
3
answers
4k
views
What are main differences between Source Code Analysis vs Static Application Security Testing(SAST)?
Do these 2 terminologies refer to the same thing?
https://www.owasp.org/index.php/Source_Code_Analysis_Tools
http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#.NET
Some of the ...
- 1
2
votes
3
answers
283
views
Cryptographically prove open sourced source code of server
I want to prove that the source code I am using is the same as the open-sourced version, which is publicly available. My idea was to publish a hash of the open-sourced version and compare it to the ...
- 21
45
votes
8
answers
9k
views
Should I bother teaching buffer overflows any more?
The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
0
votes
1
answer
186
views
How to prevent Source code excessive usage and redistribution?
We sell our code to a company that they can run our code 100 times a month. We need to do a few things before giving the code to the company.
Hide our logic (we can hide our logic by code obfuscation)...
- 5,943
34
votes
4
answers
11k
views
Which security measures does PyPI and similar third-party software repositories take?
PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)).
How does PyPI prevent people from uploading malware?
When I ...
- 928
5
votes
4
answers
6k
views
How to prevent source code theft in web application development
I'm developing a webapplication working with PHP, SQL DB and other technologies. I'm always considering someone stealing the source code or using it to other means.
How can you prevent someone from ...
- 127k
-1
votes
1
answer
490
views
What is the difference between "secure code review" and "secure static code analysis"?
What are the subtle differences in both - as one could say that both are almost the same...
Static Code Analysis (also known as Source Code Analysis) is usually
performed as part of a Code ...
- 7,379
7
votes
1
answer
2k
views
Never heard of compiler vulnerabilities when compiling?
Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code.
...
- 12.6k
2
votes
2
answers
146
views
Does removing features from a library increase or reduce security risks?
Software libraries targetting resource constrained environments like embedded systems use conditional compilation to allow consumers to shave space and thus increase performance by removing unused ...
- 4,839
0
votes
1
answer
79
views
Proving a software deployment's origin sourcecode [duplicate]
Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL?
sourcecode
from commit #10020 at ...
- 193k
12
votes
4
answers
18k
views
What programming language is Stuxnet written in?
I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in?
Is the source code for Stuxnet available anywhere?
- 65.1k
127
votes
8
answers
27k
views
Why is storing passwords in version control a bad idea?
My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?"
I gave him an answer that ...
87
votes
6
answers
20k
views
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me? [duplicate]
I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
CommunityBot
- 1
14
votes
6
answers
5k
views
Code Analysis: Binary vs Source
While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...
16
votes
7
answers
17k
views
Disable insecure/dangerous PHP functions
Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
- 1,025
1
vote
0
answers
659
views
Findbugs Source Code Analyzer not able to detect vulnerabilities in JSP file?
I am using FindBugs to do source code analysis along with Find Security Bugs plugin to specifically detect security vulnerabilities like SQL Injection, XSS, etc. I installed the FindBugs plugin for ...
3
votes
2
answers
2k
views
Is there a standard way to check if a requirements.txt has potential security issues? [closed]
Every open code repository has security issues. Attackers can use three ways to sneak malware in:
Abuse typos: Create a package with a similar name, but the package is malware
Malware + useful code: ...
- 3,641